PseudoSigner02ExeSmasherAnorganix

Hunt Hypothesis

This hunt detects adversaries leveraging pseudo-signed executables to mask malicious activity and evade signature-based defenses by mimicking legitimate software behavior. Proactively hunting for this pattern in Azure Sentinel is essential to identify early-stage supply chain compromises or fileless attacks that traditional antivirus solutions might overlook due to valid digital signatures.

YARA Rule

rule PseudoSigner02ExeSmasherAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the PseudoSigner02ExeSmasherAnorganix detection rule, along with recommended filters and exclusions:

• Scenario: Enterprise Antivirus Real-Time Scanning Engine Updates

  • Context: The sensei.exe or rtengine64.exe processes (common in CrowdStrike Falcon or SentinelOne) frequently spawn child processes to update local signature databases. These updates often involve writing new executable artifacts that mimic the “smashing” behavior of the Anorganix rule, triggering alerts when the engine re-signs or replaces cached binaries.
  • Filter/Exclusion: Add a process filter excluding ParentImage containing \Program Files\CrowdStrike\*\sensei.exe and ProcessName matching rtengine64.exe. Alternatively, exclude file paths under C:\ProgramData\CrowdStrike\Falcon\*.

• Scenario: Microsoft Endpoint Configuration Manager (SCCM) Application Deployment

  • Context: During scheduled maintenance windows, SCCM (ccmsetup.exe or ccmexec.exe) deploys new applications to endpoints. The deployment agent often extracts temporary executables to %TEMP% and executes them before cleaning up. This extraction and execution pattern frequently matches the “pseudo-signer” logic of the rule, especially when deploying signed installers that are immediately replaced by the runtime engine.
  • Filter/Exclusion: Exclude events where ParentImage contains \Microsoft Endpoint Configuration Manager\ccmexec.exe or ccmsetup.exe, and restrict the scope to file paths starting with %TEMP%\CCMSetup\*.

• Scenario: Automated Patch Management via WSUS or Intune

  • Context: The Windows Update client (usoclient.exe) or Intune Management Extension (IntuneManagementExtension.exe) runs