PseudoSigner02BJFNT11bAnorganix

Hunt Hypothesis

This YARA rule identifies files exhibiting characteristics of the PseudoSigner tool, which adversaries use to create fake digital certificates to sign malicious executables and bypass trust-based security controls. Proactively hunting for these artifacts in Azure Sentinel allows the SOC team to detect stealthy malware that may evade signature-based detections by leveraging forged code signatures to establish a false sense of legitimacy.

YARA Rule

rule PseudoSigner02BJFNT11bAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 90 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or IT admin runs a signed build artifact (e.g., a custom .NET assembly or C++ DLL) that was compiled using a specific version of the Microsoft Visual C++ Redistributable or a third-party signing tool (like signtool.exe or osslsigncode) which embeds a specific certificate chain or metadata block matching the YARA pattern. This is common in CI/CD pipelines where artifacts are signed before deployment to production servers.

  • Filter/Exclusion: Exclude processes where the parent process is cmd.exe, powershell.exe, or msbuild.exe and the file path resides within standard build directories (e.g., C:\builds\, C:\jenkins\, or C:\azure-pipelines\). Additionally, exclude files with a valid Authenticode signature where the issuer matches the internal corporate CA.

• Scenario: An enterprise endpoint protection agent (such as CrowdStrike Falcon, Carbon Black, or SentinelOne) performs a real-time scan or memory inspection of a legitimate application (e.g., chrome.exe or outlook.exe) that has been patched or updated with a custom security module. The YARA rule may match the specific byte sequence of the injected security driver or the updated PE header structure introduced by the EDR agent’s self-protection features.

  • Filter/Exclusion: Exclude files located in the vendor-specific EDR installation directories (e.g., C:\Program Files\CrowdStrike\, C:\Program Files\Carbon Black\, C:\Program Files\SentinelOne\). Also, exclude processes where the parent process is the EDR service executable (e.g., FalconSensor.exe, cb.exe, SentinelOneAgent.exe).

• Scenario: A scheduled task runs a legitimate backup or archival utility (such as Veeam, Acronis