This detection identifies potentially malicious executables utilizing a specific Borland C++ 1999 code signing certificate pattern often associated with the Anorganix pseudo-signer, which may indicate an adversary leveraging legacy or compromised signing infrastructure to evade trust-based controls. A proactive hunt is essential in Azure Sentinel to uncover stealthy threats that exploit this specific signature anomaly, as adversaries increasingly use such historical or less scrutinized certificates to establish legitimacy for malicious payloads within the environment.
rule PseudoSigner02BorlandC1999Anorganix
{
meta:
author="malware-lu"
strings:
$a0 = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 [4] A3 }
condition:
$a0 at pe.entry_point
}
This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Here are 5 specific false positive scenarios for the PseudoSigner02BorlandC1999Anorganix detection rule, along with targeted filters and exclusions:
Legacy ERP Reporting Engine Execution
C:\Program Files\SAP\Reporting\LegacyReport.exe) and its associated Process ID (PID) range during the scheduled maintenance window (02:00–04:00 AM).Third-Party Document Conversion Utility
C:\Program Files\Adobe\Acrobat DC\Acrobat\distill\* where the file hash matches the known good baseline of the specific DLL (e.g., distill.dll).Automated Backup Agent Component