PseudoSigner02CDCopsIIAnorganix

Hunt Hypothesis

This hypothesis targets the execution of malicious or unsigned binaries that utilize specific code patterns or strings associated with the “PseudoSigner” family, potentially indicating the presence of low-fidelity malware or adware in the environment. Proactively hunting for these indicators in Azure Sentinel helps identify stealthy threats that may evade standard signature-based detections, allowing the SOC to isolate compromised hosts before they progress to more impactful stages of the attack lifecycle.

YARA Rule

rule PseudoSigner02CDCopsIIAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or CI/CD pipeline uses Git LFS or Docker BuildKit to pull large binary artifacts (e.g., pre-compiled C++ libraries or static binaries) that contain embedded debug symbols or specific byte sequences matching the PseudoSigner02CDCopsIIAnorganix pattern. These binaries are often unsigned or signed with a self-signed certificate, triggering the “pseudo-signer” heuristic.

  • Filter/Exclusion: Exclude processes originating from dockerd, buildkitd, or git-lfs when the parent process is bash, sh, or python (for CI scripts). Additionally, exclude files located in standard artifact directories like /var/lib/docker/overlay2/ or ~/.cache/git-lfs/.

• Scenario: An IT administrator runs 7-Zip or WinRAR to extract a large archive containing legacy application installers or firmware images. The extraction process may temporarily create files with specific header patterns or incomplete signatures that match the YARA rule, especially if the archive contains binaries from older, less standardized signing practices.

  • Filter/Exclusion: Exclude events where the parent process is 7z.exe, WinRAR.exe, or tar.exe and the file path is within a temporary extraction directory (e.g., C:\Users\<user>\AppData\Local\Temp\ or C:\Temp\). Correlate with the creation of a new directory to confirm it’s an extraction event.

• Scenario: A Java or .NET application uses a native library (e.g., libjpeg.so, libssl.dll, or a custom JNI bridge) that is dynamically loaded via dlopen or LoadLibrary. If this library was compiled with specific optimization flags or contains a unique magic number sequence that overlaps with the `Pseudo