PseudoSigner02PEPack099Anorganix

Hunt Hypothesis

This rule identifies executable files that exhibit characteristics of the Anorganix PE packer, a technique often used by adversaries to obfuscate malicious code and evade static analysis. Proactively hunting for these signatures in Azure Sentinel allows the SOC to detect low-severity, potentially stealthy malware implants before they establish persistence or execute their payload.

YARA Rule

rule PseudoSigner02PEPack099Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of the Anorganix digital certificate verification utility (a known pseudo-signer tool) during a manual code signing audit or compliance check by the DevOps team.
  • Filter/Exclusion: Exclude processes where the parent process is powershell.exe or cmd.exe and the command line contains arguments like -verify or -check, or restrict the detection to non-interactive sessions (e.g., exclude if SessionId is 0 or 1).
• Scenario: A scheduled maintenance job runs a custom script that invokes Anorganix to validate the integrity of deployed application binaries in a staging environment.
  • Filter/Exclusion: Exclude events where the parent process is svchost.exe (Task Scheduler service) and the working directory matches the known staging path (e.g., C:\Staging\QA\), or filter by the specific scheduled task name Nightly_Cert_Verification.
• Scenario: An IT administrator uses Anorganix interactively via a remote desktop session to troubleshoot a failed code signing issue on a developer workstation.
  • Filter/Exclusion: Exclude detections where the user account is a member of the Domain Admins or IT_Ops group and the logon type is 10 (Remote Interactive), or exclude if the process is launched from the C:\Users\<Admin>\AppData\Local\ directory.
• Scenario: A CI/CD pipeline agent (e.g., Jenkins or GitLab Runner) executes Anorganix as part of a build step to sign or verify artifacts before deployment to the production repository.
  • Filter/Exclusion: Exclude processes where the parent process is the CI/CD agent executable (e.g., java.exe for Jenkins, gitlab-runner.exe)