PseudoSigner02PENightMare2BetaAnorganix

Hunt Hypothesis

This detection identifies potential NightMare (Cobalt) campaign activity by leveraging a specific YARA signature to identify the unique behavioral patterns of the PseudoSigner02PE variant within the Azure Sentinel environment. Proactive hunting for this low-severity indicator is essential to uncover early-stage lateral movement or command-and-control communications that may be missed by standard high-fidelity alerts, thereby strengthening the organization’s defense against sophisticated supply chain attacks.

YARA Rule

rule PseudoSigner02PENightMare2BetaAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the PseudoSigner02PENightMare2BetaAnorganix detection rule, including suggested filters and exclusions:

• Scenario: Automated Endpoint Protection Policy Updates

  • Context: The enterprise utilizes CrowdStrike Falcon or Microsoft Defender for Endpoint. During nightly maintenance windows (e.g., 02:00–04:00), the agent pushes signature updates and policy changes. These background processes often spawn temporary executables with non-standard signing artifacts that mimic the “PseudoSigner” behavior detected by the rule, specifically when updating the FalconSensor.exe or MsMpEng.exe service.
  • Suggested Filter/Exclusion: Create a whitelist exclusion based on the specific process image path and parent process.
    • Filter Logic: Exclude alerts where Process.ImagePath contains \Program Files\CrowdStrike\Falcon\ OR \Windows\System32\MsMpEng.exe AND ParentImageName is fsservice.exe or svchost.exe.

• Scenario: Scheduled PowerShell Script Execution via Task Scheduler

  • Context: IT Operations runs a nightly backup verification script using PowerShell 7.0+. The script invokes a custom internal tool (e.g., BackupValidator.ps1) which dynamically loads unsigned or self-signed .NET assemblies to validate data integrity. Because these assemblies are not signed by the primary enterprise CA, they trigger the “Anorganix” signature anomaly logic within the YARA rule.
  • Suggested Filter/Exclusion: Implement a time-based exclusion combined with user context filtering.
    • Filter Logic: Exclude alerts occurring between 01:00 and 06:00 (local time) where Process.CommandLine contains `-