PseudoSigner02Armadillo300Anorganix

Hunt Hypothesis

This rule identifies the presence of the PseudoSigner02Armadillo300Anorganix YARA signature, which typically indicates the execution of a specific malware variant or trojan designed to establish a foothold on compromised endpoints. Proactively hunting for this indicator in Azure Sentinel allows the SOC team to detect low-severity threats that may be used for initial access or lateral movement before they escalate into more significant incidents.

YARA Rule

rule PseudoSigner02Armadillo300Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer runs a custom-built, internally signed utility (e.g., internal-deploy-tool.exe) that was compiled with a non-standard or expired code-signing certificate, causing the YARA rule to flag the binary as a “pseudo-signer” due to its specific header structure or lack of trusted chain validation.

  • Filter/Exclusion: Exclude files located in specific development directories (e.g., C:\Dev\Tools\) or binaries with a specific internal product name string (e.g., ProductName == "InternalDeploy") from the detection logic, provided the file hash is whitelisted.

• Scenario: An IT administrator installs a legacy driver or hardware management agent (e.g., DellCommandUpdate.exe or HPClientTools.exe) that uses a self-signed certificate or a certificate from a private PKI not fully trusted by the endpoint’s root store, triggering the rule’s check for valid, widely-trusted signatures.

  • Filter/Exclusion: Add an exclusion for known vendor-specific driver folders (e.g., C:\Program Files\Dell\, C:\Program Files\HP\) or exclude executables whose SignerName matches internal vendor certificates (e.g., SignerName contains "Dell Inc.").

• Scenario: A scheduled task runs a PowerShell script wrapper that launches a custom .NET application (e.g., ReportGenerator.dll executed via dotnet.exe) where the assembly is signed with a development certificate, and the YARA rule incorrectly identifies the hosting process or the temporary extraction folder as a pseudo-signed artifact.

  • Filter/Exclusion: Exclude processes spawned by dotnet.exe or msbuild.exe when the parent process is a known build or report generation tool, or exclude files in temporary build directories (e.g., `C:\Temp