PseudoSigner02DxPack10Anorganix

Hunt Hypothesis

This detection identifies potential adversary activity involving the execution of pseudo-signed binaries or specific package structures that may indicate early-stage reconnaissance or supply chain compromise. A proactive hunt is essential to validate these low-severity signals and uncover hidden threats that might evade standard signature-based defenses within the Azure Sentinel environment.

YARA Rule

rule PseudoSigner02DxPack10Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PseudoSigner02DxPack10Anorganix detection rule, including context and suggested filters:

• Antivirus Engine Signature Updates

  • Scenario: The enterprise endpoint protection suite (e.g., Microsoft Defender Antivirus or CrowdStrike Falcon) performs a scheduled nightly update of its heuristic scanning engine. This process often extracts temporary diagnostic packages that match the PseudoSigner signature pattern due to shared code libraries in the update payload.
  • Filter/Exclusion: Exclude processes named MsMpEng.exe, Csfalcon.exe, or CrowdStrikeService.exe when they are executing from the standard installation directory (e.g., C:\Program Files\Microsoft Defender\).

• Patch Management Deployment Agents

  • Scenario: During a scheduled maintenance window, the patch management tool (e.g., Ivanti Neurons or SCCM/MECM) deploys a new application package. The deployment agent creates a temporary staging folder containing diagnostic logs and installer manifests that trigger the rule due to similar cryptographic signing structures used by Anorganix.
  • Filter/Exclusion: Create an exclusion for file paths starting with C:\Windows\CCM\Cache or C:\ProgramData\Ivanti, specifically targeting files with extensions .msi, .cab, and .log generated during the “Software Update Service” run time.

• Enterprise Backup Verification Jobs

  • Scenario: The backup solution (e.g., Veeam Backup & Replication or Commvault) runs a daily integrity check on critical database snapshots. This verification process involves unpacking metadata archives that contain pseudo-signed diagnostic blocks, which the YARA rule identifies as potential anomalies matching DxPack10.
  • Filter/Exclusion: Exclude alerts where the parent process