PseudoSigner02Gleam100Anorganix

Hunt Hypothesis

This hunt hypothesis targets adversaries employing obfuscation tactics by utilizing pseudo-signing certificates with anomalous naming patterns to evade signature-based detection and blend in as legitimate software. A SOC team should proactively hunt for this behavior in Azure Sentinel because low-severity anomalies often indicate early-stage reconnaissance or supply chain compromises that may escalate if these subtle signing irregularities are not correlated with broader user and process telemetry.

YARA Rule

rule PseudoSigner02Gleam100Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PseudoSigner02Gleam100Anorganix detection rule, including targeted filters and exclusions:

• Scenario: Scheduled Microsoft Defender Antivirus (MMP) signature updates triggering the YARA match on MpCmdRun.exe.

  • Context: During off-hours, the Windows Update service triggers a background scan where the mpcmdrun.exe process loads specific signature modules that mimic the “PseudoSigner” pattern.
  • Filter/Exclusion: Exclude processes matching ImageFileName: mpcmdrun.exe originating from the path C:\Program Files\Windows Defender\.

• Scenario: Automated deployment of Office 365 ProPlus updates via Microsoft Endpoint Configuration Manager (SCCM).

  • Context: The SCCM client service (ccmexec.exe) executes a scheduled task to patch Office applications, invoking the setup.exe which generates temporary artifacts matching the rule’s signature logic.
  • Filter/Exclusion: Create an exclusion for parent processes named ccmexec.exe when the child process is setup.exe located within C:\Program Files\Microsoft Office Root\Office16\.

• Scenario: Execution of a custom PowerShell script by the System Center Configuration Manager (SCCM) maintenance window.

  • Context: A nightly compliance check runs a PowerShell script (powershell.exe) that invokes a signed DLL for inventory collection, which contains the specific “Anorganix” metadata structure detected by the rule.
  • Filter/Exclusion: Filter out events where CommandLine contains keywords like -ExecutionPolicy Bypass -File .\ComplianceCheck.ps1 and the user context is NT AUTHORITY\SYSTEM.

• Scenario: Backup job execution using Veeam Backup & Replication agent