PseudoSigner01YodasProtector102Anorganix

Hunt Hypothesis

This detection identifies potentially malicious or suspicious executables matching the specific signature pattern of “PseudoSigner01YodasProtector102Anorganix,” which may indicate an adversary utilizing a known code signing certificate for obfuscation or initial access. SOC teams should proactively hunt for this indicator in Azure Sentinel to validate the legitimacy of these artifacts and prevent potential supply chain compromises or stealthy persistence mechanisms that leverage trusted signer identities.

YARA Rule

rule PseudoSigner01YodasProtector102Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 00 00 00 EB 01 90 90 E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the PseudoSigner01YodasProtector102Anorganix detection rule, along with targeted filters and exclusions:

• Scenario: Automated Backup Agent Execution

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik often utilize internal components that mimic the signature structure of Yodas Protector when performing incremental scans on file servers. These agents frequently spawn child processes with similar naming conventions and memory signatures during scheduled nightly windows (e.g., 02:00–04:00 AM).
  • Filter/Exclusion: Create a whitelist exclusion for the specific process path C:\Program Files\Veeam\Backup and Replication Service\Engine.exe (or equivalent for Rubrik) when running on known backup server hosts. Additionally, filter out alerts occurring strictly within the defined maintenance window (02:00–04:00 UTC).

• Scenario: Endpoint Protection Policy Updates

  • Context: When Microsoft Defender for Endpoint or CrowdStrike Falcon pushes a new policy update to the fleet, the underlying engine often triggers a re-scan of protected directories. This activity can generate process artifacts that match the “YodasProtector” signature logic due to shared cryptographic libraries used in modern EDR agents.
  • Filter/Exclusion: Implement a rule exclusion based on the parent process name MsMpEng.exe (Defender) or C:\Program Files\CrowdStrike\fsqh.exe. If the child process matches the YARA signature but is spawned by these known EDR parents, suppress the alert.

• Scenario: Scheduled Patch Deployment via SCCM

  • Context: During monthly patch cycles managed by **Microsoft Endpoint Configuration Manager (MECM/SCCM