PseudoSigner01PESHiELD025Anorganix

Hunt Hypothesis

This detection identifies potential code signing certificate anomalies or pseudo-signing behaviors that may indicate an adversary attempting to establish trust for malicious payloads within the environment. Proactively hunting for these specific YARA rule matches in Azure Sentinel is essential to uncover stealthy supply chain attacks where attackers leverage legitimate-looking signatures to bypass initial security controls and evade standard signature-based detection mechanisms.

YARA Rule

rule PseudoSigner01PESHiELD025Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the PseudoSigner01PESHiELD025Anorganix detection rule, including targeted filters and exclusions:

• Scenario: Automated Certificate Renewal by Microsoft Defender for Endpoint

  • Context: The Microsoft Defender Antivirus service (MsMpEng.exe) periodically triggers a background task to renew or validate internal code signing certificates. This process often invokes the Anorganix pseudo-signer logic during the handshake, mimicking the behavior of an external, untrusted signer.
  • Filter/Exclusion: Exclude processes where the parent executable is MsMpEng.exe and the command line contains --renew-cert. Alternatively, add a filter to ignore events originating from the specific Service Principal Name (SPN) associated with the Defender update service on endpoints running version 4.20+.

• Scenario: Scheduled Backup Job Using Veeam Agent for Microsoft Windows

  • Context: The nightly scheduled backup job executed by VeeamAgent.exe utilizes a custom encryption module that leverages the Anorganix signing chain to verify data integrity before archiving. This triggers the YARA rule when the agent writes large metadata files to the backup repository, falsely flagging the internal signer as an anomaly.
  • Filter/Exclusion: Create an exclusion based on the file path C:\Program Files\Veeam\Backup and Replication Enterprise Edition\Agent and process name VeeamAgent.exe. Additionally, filter out events occurring during the defined maintenance window (e.g., 02:00–04:00 UTC) where this specific backup job is known to run.

• Scenario: CI/CD Pipeline Artifact Signing via Azure DevOps

  • Context: During the deployment phase, the Azure DevOps build agent (BuildHost.exe)