PseudoSigner02MinGWGCC2xAnorganix

Hunt Hypothesis

This rule identifies executable files compiled with MinGW GCC 2.x that exhibit specific string patterns associated with the “Anorganix” pseudo-signature, a technique often used by threat actors to obfuscate malicious binaries and evade basic signature-based detection. Proactively hunting for these artifacts in Azure Sentinel allows the SOC team to uncover low-fidelity or legacy malware variants that may have slipped past initial endpoint protections, ensuring comprehensive coverage against stealthy file-based threats.

YARA Rule

rule PseudoSigner02MinGWGCC2xAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer compiles a custom utility or internal tool using the MinGW-w64 GCC compiler (versions 2.x or later) on a Windows build server or developer workstation, resulting in a binary that lacks a valid Authenticode signature but contains specific GCC string markers.

  • Filter/Exclusion: Exclude files located in designated build directories (e.g., C:\Builds\, C:\dev\) or exclude processes where the parent process is a known compiler or build tool (e.g., make.exe, cmake.exe, ninja.exe).

• Scenario: An IT administrator installs a legacy open-source application or a custom script wrapper that was compiled with MinGW GCC and distributed without a code-signing certificate, often used for internal automation tasks or scheduled maintenance jobs.

  • Filter/Exclusion: Exclude binaries that are part of a known software suite or application directory (e.g., C:\Program Files\InternalTools\) and verify that the file hash matches a known good baseline in the asset inventory.

• Scenario: A CI/CD pipeline agent on a Windows build node executes a step that compiles a C/C++ component using MinGW GCC to generate a native Windows executable for testing, which is then temporarily stored in a workspace directory before being uploaded to an artifact repository.

  • Filter/Exclusion: Exclude files in temporary workspace directories (e.g., C:\jenkins\workspace\, C:\azure-pipelines\) and exclude if the parent process is a CI/CD agent service (e.g., jenkins.exe, vsts-agent.exe).

• Scenario: A security team or developer uses a MinGW-compiled version of a common utility (such as curl.exe, wget.exe, or a custom hasher.exe) for ad-hoc network testing or file integrity checks,