PseudoSigner02VideoLanClientAnorganix

Hunt Hypothesis

This rule detects the presence of the PseudoSigner02 VideoLanClient Anorganix component, which is often associated with legacy or third-party video conferencing software that may be exploited for lateral movement or persistence. Proactively hunting for this artifact allows the SOC team to identify potentially outdated or unmanaged client installations that could serve as a foothold for adversaries targeting video communication channels within the Azure Sentinel environment.

YARA Rule

rule PseudoSigner02VideoLanClientAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A legacy video conferencing client (e.g., older versions of Polycom, LifeSize, or specific industry-specific LAN video tools) is installed on endpoints for conference room setups or specialized industrial monitoring. The binary often resides in C:\Program Files\VideoLANClient\ or similar vendor-specific directories and may be signed with a generic or outdated certificate that matches the “PseudoSigner” heuristic.

  • Filter/Exclusion: Exclude processes where the image path matches C:\Program Files\*Video*Client*\*.exe or C:\Program Files (x86)\*Video*Client*\*.exe, specifically if the parent process is a service controller or a known conference room management agent (e.g., RoomController.exe, PolycomService.exe).

• Scenario: An IT administrator performs a manual test of a new video streaming or LAN-based video distribution tool (e.g., a custom internal tool named AnorganixVideoLan.exe or a trial version of a commercial product) from a network share or USB drive. The file is executed directly from a non-standard location like C:\Users\Admin\Downloads\ or \\fileserver\tools\, triggering the rule due to the unusual path and potential lack of a trusted digital signature.

  • Filter/Exclusion: Exclude executions where the image path contains \\fileserver\tools\ or C:\Users\Admin\Downloads\ AND the parent process is explorer.exe or cmd.exe (indicating manual user/admin action rather than automated execution).

• Scenario: A scheduled task or service for a video asset management system (e.g., Adobe Media Server, a custom CMS, or a video transcoding service) runs a helper executable named VideoLanClientHelper.exe or similar. This helper process is launched by a parent service (e.g.,