PseudoSigner02NorthStarPEShrinker13Anorganix

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging the specific PseudoSigner02NorthStarPEShrinker13Anorganix signature to execute stealthy file modifications or obfuscation techniques that may evade standard detection mechanisms. Proactive hunting in Azure Sentinel is essential because this low-severity indicator often represents early-stage reconnaissance or lateral movement activities that, if unaddressed, could evolve into significant compromises within the environment.

YARA Rule

rule PseudoSigner02NorthStarPEShrinker13Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PseudoSigner02NorthStarPEShrinker13Anorganix detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Microsoft Office 365 ProPlus Update Deployment

  • Context: The OfficeC2RClient.exe process triggers the YARA signature during its nightly automatic update cycle. This occurs when the update service downloads and validates new language packs or feature updates, which often contain compressed payloads matching the “Shrinker” logic in the rule.
  • Suggested Filter/Exclusion: Create a process exclusion for C:\Program Files\Microsoft Office\root\Office16\OfficeC2RClient.exe and restrict detection to non-business hours (e.g., 01:00–05:00) or exclude the specific command line arguments containing /UpdateType=Automatic.

• Scenario: Enterprise Antivirus (CrowdStrike Falcon) Real-Time Scan

  • Context: The CrowdStrike csanalyzer.exe or falcon.sys driver performs real-time heuristic scanning on user-generated documents. When scanning large archives (.zip/.7z) containing nested executables, the signature logic mimics the “PseudoSigner” behavior defined in the rule, causing a hit during routine file access by end-users.
  • Suggested Filter/Exclusion: Exclude the process C:\ProgramData\CrowdStrike\csanalyzer.exe from the YARA scan scope. Alternatively, add an exclusion for file paths under C:\Users\<User>\AppData\Local\Temp where temporary extraction often occurs.

• Scenario: Automated Backup Job via Veeam Agent

  • Context: The nightly Veeam backup agent (VeeamAgent.exe) compresses and encrypts database logs before transmission