PseudoSigner02DEF10Anorganix

Hunt Hypothesis

This rule identifies executable files signed by the “PseudoSigner02DEF10Anorganix” certificate, a known indicator of potentially malicious or obfuscated binaries often used to bypass signature-based trust mechanisms. Proactively hunting for this specific signer in Azure Sentinel allows the SOC team to detect low-severity threats that may be leveraging trusted code signing to blend in with legitimate software and evade initial detection layers.

YARA Rule

rule PseudoSigner02DEF10Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or IT administrator uses a custom PowerShell script or a specific build tool (e.g., a modified version of MSBuild or a custom C# compiler wrapper) to compile and sign internal microservices or test binaries that intentionally mimic the structural characteristics of the “Anorganix” signer to bypass strict code signing policies in development environments.

  • Filter/Exclusion: Exclude files located in specific development directories (e.g., C:\Dev\, C:\Projects\) or exclude processes initiated by known build agents (e.g., VSTSvc, JenkinsAgent) when the parent process is a known IDE or build tool (e.g., devenv.exe, msbuild.exe).

• Scenario: A legacy line-of-business application or a specific vendor-provided utility (e.g., a custom installer for a niche hardware driver or a specialized data migration tool) uses a non-standard signing algorithm or a self-signed certificate that matches the YARA pattern for “PseudoSigner02DEF10Anorganix” due to its unique binary structure or embedded metadata.

  • Filter/Exclusion: Create a whitelist for known executable paths associated with specific vendor products (e.g., C:\Program Files\VendorApp\bin\*.exe) or exclude files where the digital signature issuer matches a known internal CA or vendor-specific certificate name, provided the file hash is verified against a baseline.

• Scenario: An automated scheduled task (e.g., a nightly log rotation or data archival job) uses a custom Perl or Python script that generates temporary executable stubs or wrapper scripts to invoke underlying system commands, and these generated artifacts temporarily reside in a temp directory with a structure that triggers the YARA rule before being cleaned up.

  • Filter/Exclusion: Exclude files located in standard temporary directories (e.g., `C:\Windows\Temp