PseudoSigner01VBOX43MTEAnorganix

Hunt Hypothesis

This rule detects the execution of a known PseudoSigner variant, a tool frequently used by adversaries to generate fake code signatures and bypass security controls during initial access or lateral movement. Proactively hunting for this signature in Azure Sentinel allows the SOC to identify compromised endpoints or malicious artifacts before they are leveraged to establish persistence or escalate privileges.

YARA Rule

rule PseudoSigner01VBOX43MTEAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or QA engineer runs a local virtualization environment (e.g., VirtualBox) to test application compatibility, where the VBoxSVC (VirtualBox Service) or VBoxHeadless process is signed with a generic or pseudo-signature that matches the rule’s hash or string criteria.
  • Filter/Exclusion: Exclude processes where the parent process is VBoxSVC.exe or VBoxHeadless.exe, or exclude files located in the standard VirtualBox installation directory (e.g., C:\Program Files\Oracle\VirtualBox\).
• Scenario: An IT administrator installs or updates a third-party monitoring agent (e.g., Dynatrace, New Relic, or AppDynamics) that includes a native module or helper binary named with a pattern resembling the rule’s trigger (e.g., containing “MTE” or “Anorganix” in the filename or internal metadata) for telemetry collection.
  • Filter/Exclusion: Exclude files whose path contains specific agent directories (e.g., C:\Program Files\Dynatrace\ or C:\Program Files\New Relic\) or exclude processes where the command line contains agent-specific arguments like --agent or --collect.
• Scenario: A scheduled task runs a custom internal build script or CI/CD runner (e.g., Jenkins agent, GitLab Runner, or Azure DevOps agent) that executes a compiled binary with a non-standard name (e.g., anorganix_helper.exe or mte_sync.dll) used for artifact packaging or dependency resolution.
  • Filter/Exclusion: Exclude processes where the parent process is a known CI/CD agent (e.g., jenkins.exe, gitlab-runner.exe, or vstsagent.exe) or exclude files located in the agent’s workspace directory (e