PseudoSigner01PEtite2xlevel0Anorganix

Hunt Hypothesis

This detection identifies potentially malicious or suspicious executables exhibiting specific pseudo-signing characteristics that may indicate an adversary attempting to bypass signature-based defenses through obfuscation techniques. Proactive hunting for this behavior in Azure Sentinel is essential to uncover stealthy threats that evade standard high-severity alerts, allowing the SOC team to validate the legitimacy of low-severity anomalies before they escalate into broader compromises.

YARA Rule

rule PseudoSigner01PEtite2xlevel0Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 68 [4] 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 B8 00 90 90 00 6A 00 68 90 90 90 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 03 00 68 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PseudoSigner01PEtite2xlevel0Anorganix detection rule, along with targeted filters and exclusions:

• Scenario: Automated Patch Deployment via SCCM/Intune

  • Context: During scheduled maintenance windows, System Center Configuration Manager (SCCM) or Microsoft Intune pushes cumulative updates. The deployment agent (ccmsetup.exe or Microsoft.IntuneManagementAgent) creates temporary PE executables in the %TEMP% directory that match the “PseudoSigner” signature pattern but lack full organizational metadata due to being transient artifacts of the installer process.
  • Filter/Exclusion: Exclude processes where the parent executable is ccmsetup.exe, Microsoft.IntuneManagementAgent.exe, or TaskHostW.exe and the file path contains \Windows\CCM\ or \AppData\Local\Microsoft\Intune Management Extension\. Additionally, filter out events occurring strictly between 01:00 and 04:00 on weekdays.

• Scenario: Antivirus Definition Updates (CrowdStrike/SentinelOne)

  • Context: Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon or SentinelOne frequently download new definition packs. The update service extracts a compressed archive containing .exe files that are signed by the vendor’s generic “PseudoSigner” certificate before being fully integrated into the main database, triggering the rule on the extraction phase.
  • Filter/Exclusion: Whitelist file paths under C:\ProgramData\CrowdStrike\ or C:\Program Files\SentinelOne\SentinelOne Agent\. Apply a filter to ignore events where the process name is falcon.sys, SentinelAgent.exe, and the parent process is svchost.exe running as the SYSTEM account