PseudoSigner01PEX099Anorganix

Hunt Hypothesis

This YARA rule identifies potentially malicious or obfuscated executables that exhibit characteristics of pseudo-signing or specific code patterns associated with the Anorganix family, often used to evade standard signature-based detection. Proactively hunting for these artifacts in Azure Sentinel allows the SOC team to uncover low-severity threats that may indicate early-stage reconnaissance or the use of custom tooling before they escalate to more impactful post-exploitation activities.

YARA Rule

rule PseudoSigner01PEX099Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of the Anorganix digital signature verification utility by the IT Security team during a quarterly certificate audit.
  • Filter/Exclusion: Exclude files located in the C:\Program Files\Anorganix\ directory or executed by the SecurityAudit service account.
• Scenario: The Anorganix CLI tool is invoked by a PowerShell script within a scheduled task named “NightlyCertCheck” to validate code signing certificates on deployed application binaries.
  • Filter/Exclusion: Exclude processes where the parent process is powershell.exe and the command line contains Anorganix and verify-cert.
• Scenario: A developer runs the Anorganix tool locally from a development machine to test new build artifacts before pushing to the CI/CD pipeline, using the standard user account dev-team-01.
  • Filter/Exclusion: Exclude events where the source path matches C:\Users\dev-team-01\Projects\ and the process name is anorganix.exe.
• Scenario: The Anorganix tool is bundled within the CodeSignerPro application suite and executed as a child process when an administrator clicks “Verify All” in the GUI.
  • Filter/Exclusion: Exclude processes where the parent process is CodeSignerPro.exe and the process name is anorganix.exe.
• Scenario: A CI/CD agent on the build server runs Anorganix as part of the post-build verification step defined in the build-pipeline.yml script.
  • Filter/Exclusion: Exclude processes executed by the ci-agent service account where the working directory contains build-output or artifacts.