PseudoSigner02VBOX43MTEAnorganix

Hunt Hypothesis

This detection identifies potential adversary activity involving pseudo-signed binaries or virtualized execution environments that may indicate early-stage reconnaissance or supply chain compromise attempts. A proactive hunt is essential within Azure Sentinel to uncover stealthy threats leveraging these specific signing artifacts before they escalate into more severe incidents, given the rule’s low severity which might otherwise be overlooked in routine monitoring.

YARA Rule

rule PseudoSigner02VBOX43MTEAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PseudoSigner02VBOX43MTEAnorganix detection rule, including suggested filters and exclusions:

• Scenario: VirtualBox Guest Additions Auto-Update Service

  • Context: The VBoxService.exe or VBoxTray.exe processes on endpoints running Oracle VM VirtualBox often trigger this signature when the “Guest Additions” component performs a background update or re-initializes the pseudo-signing certificate store. This is common in desktop virtualization labs and developer workstations.
  • Filter/Exclusion: Exclude file paths containing C:\Program Files\Oracle\VirtualBox and process names matching VBoxService.exe, VBoxTray.exe, or VBoxHeadless.exe.

• Scenario: Microsoft Teams Meeting Recording & Transcription Engine

  • Context: When users record meetings with AI-driven transcription enabled, the background service TeamsMeetingApp.exe (or related worker processes) generates temporary pseudo-signed artifacts for the “Anorganix” media processing module. This frequently occurs during scheduled end-of-day meeting summaries or large-scale webinars.
  • Filter/Exclusion: Create an exclusion rule for the process path C:\Users\<User>\AppData\Local\Microsoft\Teams\current and filter events where the parent process is TeamsMeetingApp.exe.

• Scenario: Endpoint Protection (e.g., CrowdStrike or SentinelOne) Scheduled Scans

  • Context: During scheduled nightly scans, the EDR agent’s heuristic engine may instantiate a temporary sandbox environment using the “VBOX43” virtualization layer to analyze new executables. The rule triggers when the scanner writes pseudo-signed logs or quarantine manifests that match the YARA signature.
  • Filter/Exclusion: Exclude events where the parent process is