PseudoSigner02MicrosoftVisualC70DLLAnorganix

Hunt Hypothesis

This detection identifies potentially malicious DLLs that exhibit anomalous code signing characteristics, specifically where Microsoft Visual C++ 7.0 binaries display inconsistent or non-standard signer patterns indicative of pseudo-signing attacks. A SOC team should proactively hunt for these artifacts in Azure Sentinel to uncover stealthy supply chain compromises or living-off-the-land techniques that may evade traditional signature-based defenses due to their low severity and subtle behavioral anomalies.

YARA Rule

rule PseudoSigner02MicrosoftVisualC70DLLAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PseudoSigner02MicrosoftVisualC70DLLAnorganix detection rule, along with suggested filters and exclusions:

• Scenario: Microsoft Visual Studio Build Artifacts in Dev Environments

  • Context: Developers running local builds or CI/CD pipelines (e.g., Azure DevOps Agents) often compile C++ projects using the MSVC 2015 toolset. The resulting .dll files may lack a full certificate chain during intermediate build stages, triggering the “PseudoSigner” flag for Microsoft Visual C++ 7.0 or similar legacy DLLs.
  • Filter/Exclusion: Create an exclusion based on the process path and user context. Exclude any execution where the parent process is msbuild.exe, devenv.exe, or tfsagent.exe running under service accounts (e.g., NT SERVICE\BuildAgent) within the C:\DevOps\Agents\ directory tree.

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise endpoint protection suites like Microsoft Defender for Endpoint or Symantec Endpoint Protection frequently extract and load legacy DLL components during scheduled definition updates (e.g., at 02:00 AM). These internal engine modules often utilize the Visual C++ runtime libraries that match the rule’s signature but are not signed with a standard commercial certificate in the initial extraction phase.
  • Filter/Exclusion: Filter alerts where the parent process is MsMpEng.exe (Defender) or Rtvscan64.exe (Symantec). Add a time-based exclusion for these processes during their known maintenance windows (e.g., 01:30–02:30 daily) to suppress noise.

• Scenario: Legacy ERP Reporting Services Execution