PseudoSigner02PEIntro10Anorganix

Hunt Hypothesis

This rule targets executable files exhibiting specific PE header characteristics associated with the PseudoSigner02 tool, indicating potential use of a known malware family or a custom variant for initial access or privilege escalation. Proactively hunting for these artifacts in Azure Sentinel allows the SOC to identify compromised endpoints or staged payloads before they execute, reducing the dwell time of threats that may evade standard signature-based detections.

YARA Rule

rule PseudoSigner02PEIntro10Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of the Anorganix digital signature verification utility during a routine patch compliance audit.
  • Filter/Exclusion: Exclude processes where the parent process is powershell.exe or pwsh.exe and the command line arguments contain -Verify or -CheckSignatures.
• Scenario: Automated build pipeline step where a CI/CD agent (e.g., Jenkins or Azure DevOps) invokes the Anorganix tool to validate code artifacts before deployment.
  • Filter/Exclusion: Exclude executions where the parent process is a known CI/CD agent binary (e.g., java.exe for Jenkins, node.exe for Azure DevOps) and the working directory matches the build agent’s workspace path.
• Scenario: Security team running a manual threat hunt using the Anorganix PE introspection tool to analyze a suspicious binary in an isolated sandbox environment.
  • Filter/Exclusion: Exclude executions where the user account belongs to the SecurityOps or ThreatHunt group and the process is launched from a dedicated analysis folder (e.g., C:\ThreatHunt\Tools\).
• Scenario: Scheduled task triggered by the UpdateSignatures job that uses Anorganix to re-verify the integrity of critical system binaries after a major OS update.
  • Filter/Exclusion: Exclude executions where the parent process is schtasks.exe or Task Scheduler service (svchost.exe with specific task ID) and the process name matches the expected utility binary name.
• Scenario: Development team using Anorganix as part of a local pre-commit hook in a Git client (e.g., Git Bash or VS Code) to ensure code is signed before pushing to the repository.
  • **Filter/Ex