PseudoSigner02LocklessIntroPackAnorganix

Hunt Hypothesis

This detection identifies potentially malicious or anomalous executables characterized by specific pseudo-signing patterns and lockless introduction packaging mechanisms that may indicate early-stage supply chain compromise or obfuscated malware. A proactive hunt is essential in Azure Sentinel to uncover these subtle indicators before they escalate, ensuring the organization can validate legitimate software artifacts against emerging threats that evade standard signature-based defenses.

YARA Rule

rule PseudoSigner02LocklessIntroPackAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PseudoSigner02LocklessIntroPackAnorganix detection rule, including suggested filters and exclusions:

• Scenario: Automated deployment of Microsoft Office updates via Configuration Manager (SCCM/MECM) or Intune.

  • Context: During scheduled maintenance windows, the update client (OfficeC2RClient.exe) extracts temporary installation packages that match the “LocklessIntroPack” signature pattern before finalizing the registry keys.
  • Filter/Exclusion: Exclude processes where ImageFileName matches OfficeC2RClient.exe, Setup.exe (Microsoft Office), or IntuneManagementExtension.exe running under the context of a scheduled task named “OfficeUpdateDeployment”.

• Scenario: Execution of third-party antivirus definition updates (e.g., CrowdStrike Falcon, SentinelOne).

  • Context: Security agents frequently download and unpack lightweight signature packs in memory before applying them to the kernel. These temporary unpacked binaries often lack full digital signatures during the initial extraction phase, triggering the “PseudoSigner” logic.
  • Filter/Exclusion: Add a whitelist for process paths containing \Program Files\CrowdStrike\ or \Program Files\SentinelOne\SentinelOne\, specifically filtering events where ProcessCommandLine contains keywords like “definition_update” or “unpack”.

• Scenario: Scheduled PowerShell scripts running enterprise-wide patching routines.

  • Context: Admins often use PowerShell to invoke silent installers for internal tools (e.g., Adobe Acrobat Reader updates). The script creates a temporary working directory where the installer extracts an unsigned intermediate package before signing the final executable.
  • Filter/Exclusion: Exclude events where ParentImageFileName is powershell.exe or pwsh.exe, and the CommandLine includes arguments referencing