← Back to SOC feed Coverage →

PseudoSigner02MicrosoftVisualBasic5060Anorganix

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-09-05T23:00:00Z · Confidence: medium

Hunt Hypothesis

This rule identifies potentially malicious or obfuscated Visual Basic scripts that leverage the “PseudoSigner” technique to masquerade as trusted Microsoft binaries, a common tactic used to bypass signature-based detection. Proactively hunting for these artifacts in Azure Sentinel allows the SOC to uncover stealthy initial access or lateral movement attempts that may have evaded standard endpoint controls due to their low severity classification.

YARA Rule

rule PseudoSigner02MicrosoftVisualBasic5060Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 [4] E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/packers/packer.yar