PseudoSigner02PESHiELD025Anorganix

Hunt Hypothesis

This rule identifies executable files that exhibit characteristics of the PseudoSigner tool, a utility often used by adversaries to create fake digital signatures to bypass security controls and establish trust. Proactively hunting for these artifacts in Azure Sentinel allows the SOC to detect potentially malicious or obfuscated binaries that may be leveraging signature spoofing to evade detection during initial access or lateral movement phases.

YARA Rule

rule PseudoSigner02PESHiELD025Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or build engineer uses PEShield (or a similar PE header manipulation tool) to strip or modify the digital signature from a custom internal utility (e.g., internal-deploy-helper.exe) before deploying it to a staging environment. The tool rewrites the PE header, triggering the YARA rule which looks for specific structural anomalies or known PseudoSigner patterns.

  • Filter/Exclusion: Exclude files located in specific build artifact directories (e.g., C:\Builds\staging\bin\) or exclude processes spawned by known build agents (e.g., jenkins-agent.exe, azuredevops-agent.exe) where the parent process is a recognized CI/CD service.

• Scenario: An IT administrator uses PowerShell with the System.Reflection namespace or a third-party module like PE-Explorer to inspect or patch a legacy application binary (e.g., legacy-reporting-tool.exe) to remove a broken signature that is causing UAC prompts. The modification process involves in-memory or on-disk PE header adjustments that match the YARA signature.

  • Filter/Exclusion: Exclude events where the modifying process is powershell.exe or pwsh.exe and the target file resides in standard application install directories (e.g., C:\Program Files\, C:\Program Files (x86)\) but is not in a known “trusted” subfolder, OR exclude if the user belongs to the LocalAdmins group and the action is logged as a “Maintenance” task in the event log.

• Scenario: A security team performs a Vulnerability Assessment or Patch Testing using tools like Nessus or Qualys agents that download and temporarily modify test binaries to verify signature validity or apply test patches. The agent may use a pseudo-signer utility