PseudoSigner02LCCWin321xAnorganix

Hunt Hypothesis

This detection identifies potentially malicious Win32 executables that exhibit suspicious code signing characteristics associated with the Anorganix pseudo-signing pattern, which often indicates an adversary attempting to bypass trust mechanisms through forged or reused certificates. A proactive hunt is essential in Azure Sentinel to uncover stealthy initial access attempts where attackers leverage these specific signature anomalies to establish persistence while evading standard signature-based defenses.

YARA Rule

rule PseudoSigner02LCCWin321xAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 64 A1 01 00 00 00 55 89 E5 6A FF 68 [4] 68 9A 10 40 90 50 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PseudoSigner02LCCWin321xAnorganix detection rule, including suggested filters and exclusions:

• Scenario: Legitimate execution of Microsoft Office Click-to-Run updates during business hours.

  • Context: The background update service (OfficeClickToRun.exe) often launches temporary processes with pseudo-signed certificates that match the “Anorganix” signature pattern while downloading or installing patches.
  • Filter/Exclusion: Exclude process paths containing C:\Program Files\Microsoft Office\root\Office16 and specifically filter for parent process names ClickToRun.exe or OfficeBackgroundTaskHandler.exe.

• Scenario: Scheduled task execution of Sysinternals Process Explorer or Process Monitor by security analysts.

  • Context: When analysts run these tools to investigate system behavior, they often spawn child processes that inherit the pseudo-signature characteristics defined in the rule, triggering alerts during routine audits.
  • Filter/Exclusion: Create an exclusion for process names ProcExp.exe, ProcMon.exe, and Pstools.exe located within the standard administrative tool directory (e.g., C:\Tools\Sysinternals\).

• Scenario: Automated deployment of VMware Horizon or Citrix Workspace client updates.

  • Context: Virtual desktop infrastructure agents frequently perform self-healing checks and component installations using temporary signing keys that resemble the Anorganix profile, particularly on Windows 10/11 endpoints.
  • Filter/Exclusion: Filter out events where the parent process is HvAgent.exe (VMware) or wfcrun.exe (Citrix) and the file path resides under C:\Program Files\VMware or `C:\Program Files\C