This rule identifies potentially malicious or obfuscated Visual Basic scripts that leverage the “PseudoSigner” technique to masquerade as trusted Microsoft binaries, a common tactic used to bypass signature-based detection. Proactively hunting for these artifacts in Azure Sentinel allows the SOC to uncover stealthy initial access or lateral movement attempts that may have evaded standard endpoint controls due to their low severity classification.
rule PseudoSigner02MicrosoftVisualBasic5060Anorganix
{
meta:
author="malware-lu"
strings:
$a0 = { 68 [4] E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 }
condition:
$a0 at pe.entry_point
}
This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Legacy VB6 Application Deployment via Group Policy:
C:\Windows\Installer\, C:\Program Files\LegacyApps\) and specifically filter for executables where the ProductVersion or FileDescription contains “Visual Basic” and the signer matches the known legacy vendor name “Anorganix” or “Microsoft Visual Basic 5.0/6.0”.Scheduled Maintenance Job for Legacy Reporting Tool:
DailySalesReport) runs a small utility written in VB6 to aggregate data from a legacy SQL Server. The binary is a small, statically linked VB5/6 executable that has been in the environment for years but was recently recompiled or copied to a new server, causing the YARA rule to fire during the scheduled execution window.svchost.exe (Task Scheduler) and the file path matching the known location of the reporting tool (e.g., C:\Tools\Reports\GenReport.exe). Add an exclusion for this specific file hash if it is verified as the legitimate legacy binary.Development Environment Testing with Old SDKs: