PseudoSigner02FSG10Anorganix

Hunt Hypothesis

This detection identifies potential code signing anomalies where executables exhibit characteristics of pseudo-signers or anomalous digital signatures that may indicate supply chain compromise or certificate abuse. Proactive hunting for this behavior in Azure Sentinel is critical to uncover stealthy adversaries leveraging forged identities to bypass standard security controls and establish a foothold within the environment.

YARA Rule

rule PseudoSigner02FSG10Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 68 [4] 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PseudoSigner02FSG10Anorganix detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Antivirus Definition Updates via Windows Update

  • Context: The Windows Update service (wuauserv.exe) or the Microsoft Defender Antivirus engine (MsMpEng.exe) frequently downloads and installs signature definition updates. These updates often contain embedded pseudo-signatures that match the PseudoSigner02FSG10Anorganix pattern, triggering alerts during scheduled maintenance windows (e.g., Tuesday 3:00 AM).
  • Filter/Exclusion: Exclude processes running under the Microsoft-Windows-Update-Agent service context or filter by process name wuauserv.exe and MsMpEng.exe. Additionally, add a time-based exclusion for the specific maintenance window (e.g., 02:00–05:00).

• Scenario: Endpoint Detection and Response (EDR) Agent Self-Scanning

  • Context: Enterprise EDR agents such as CrowdStrike Falcon, SentinelOne, or Carbon Black perform internal health checks and update their own sensor binaries. These agents often utilize pseudo-signing mechanisms for their proprietary modules, which can be misidentified by the YARA rule as external threats when the agent updates its own signature database.
  • Filter/Exclusion: Create a whitelist exclusion based on the specific EDR process names (e.g., C-Drive.exe, SentinelOne.exe, cbengine.exe) and their installation paths (typically C:\Program Files\...). Ensure the rule ignores events where the parent process is the EDR service itself.

• Scenario: Scheduled PowerShell Script Execution for Compliance Reporting

  ---