PseudoSigner02PEX099Anorganix

Hunt Hypothesis

This rule identifies executable files that exhibit characteristics of the PseudoSigner02PEX099Anorganix YARA signature, suggesting the presence of potentially unsigned or obfuscated binaries often used for initial access or privilege escalation. Proactively hunting for these artifacts in Azure Sentinel allows the SOC team to detect stealthy malware or trojans that may evade standard signature-based detections before they establish a foothold in the environment.

YARA Rule

rule PseudoSigner02PEX099Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of the Anorganix digital signature verification utility (e.g., anorganix_verify.exe) by a security operations team during a manual audit of third-party vendor software.
  • Filter/Exclusion: Exclude processes where the parent process is a known security tool (e.g., powershell.exe, cmd.exe, or python.exe) and the command line contains arguments like -verify, -check, or -audit.
• Scenario: A scheduled maintenance job using Windows Task Scheduler runs a custom batch script (run_anorganix_check.bat) that invokes the Anorganix binary to validate the integrity of deployed application binaries in a staging environment.
  • Filter/Exclusion: Exclude executions where the parent process is schtasks.exe or taskeng.exe and the working directory is a known staging or QA path (e.g., C:\Staging\, D:\QA\).
• Scenario: A developer running Visual Studio Code or JetBrains IDE triggers a post-build hook that executes the Anorganix tool to sign or verify newly compiled .exe files before deployment to the test environment.
  • Filter/Exclusion: Exclude processes where the parent process is an IDE-related binary (e.g., code.exe, idea64.exe, devenv.exe) and the file path ends in a build or output directory (e.g., \bin\, \out\, \dist\).
• Scenario: An automated CI/CD pipeline agent (e.g., Jenkins or Azure DevOps) executes the Anorganix binary as part of a build step to ensure all artifacts are properly signed before promotion to the production repository.
  • Filter/Exclusion: Exclude executions where the parent process is a CI/CD agent binary (e.g