PseudoSigner02CodeLockAnorganix

Hunt Hypothesis

This rule identifies malicious code artifacts associated with the PseudoSigner02CodeLockAnorganix family, which adversaries use to execute or persist in memory while evading standard signature-based detection. Proactively hunting for this indicator in Azure Sentinel allows the SOC to uncover low-severity compromises that may serve as initial footholds or lateral movement vectors before they escalate into more significant incidents.

YARA Rule

rule PseudoSigner02CodeLockAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or build engineer uses a custom C# or .NET wrapper to invoke the CodeLock utility (or a similar binary named Anorganix) to encrypt or lock source code assets during a nightly CI/CD pipeline run. The process may spawn a child process or write temporary lock files that match the YARA signature’s structural patterns.
  • Filter/Exclusion: Exclude the rule if the parent process is dotnet.exe, msbuild.exe, or vsts-agent.exe and the file path contains \builds\ or \artifacts\.
• Scenario: An IT administrator deploys a legacy internal tool named Anorganix (a proprietary data locker) via Group Policy or SCCM to endpoint machines. The tool runs as a scheduled task to perform daily integrity checks, creating a short-lived process that matches the “PseudoSigner” heuristic due to its specific header structure.
  • Filter/Exclusion: Exclude if the executable path is under C:\Program Files\InternalTools\Anorganix\ or if the process is launched by Task Scheduler (svchost.exe with Tasks parameter) and the user context is SYSTEM.
• Scenario: A security team runs a manual penetration test or red team exercise using a custom implant or obfuscation tool named Anorganix to simulate a pseudo-signed code injection. This is a known test case that triggers the rule during scheduled vulnerability assessments.
  • Filter/Exclusion: Exclude if the process is initiated by a known red team account (e.g., svc-redteam) or if the file hash matches a pre-approved allowlist of test artifacts.
• Scenario: A Java or .NET application uses a third-party library (e.g., a custom CodeLock wrapper) that bundles the Anorganix