PseudoSigner02VOBProtectCD5Anorganix

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging obfuscated executables with pseudo-signatures to evade static analysis and blend in as legitimate software within the Azure Sentinel environment. Proactive hunting for this specific YARA signature is essential because these low-severity indicators often represent early-stage lateral movement or persistence mechanisms that may be missed by standard alerting thresholds until they escalate into active compromises.

YARA Rule

rule PseudoSigner02VOBProtectCD5Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 36 3E 26 8A C0 60 E8 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the PseudoSigner02VOBProtectCD5Anorganix detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Antivirus Definition Updates via VOB Protect

  • Context: The enterprise uses Symantec Endpoint Protection (SEP) or a similar agent that utilizes the “VOB Protect” engine. During nightly maintenance windows (e.g., 02:00 AM), the Symantec Security Center service triggers an automated update of virus definition signatures. This process often involves the extraction and signing of new definition packages using the Anorganix pseudo-signer chain, which matches the YARA rule’s signature for legitimate updates rather than malicious activity.
  • Suggested Filter/Exclusion: Create a whitelist exclusion based on the specific file path and process name: C:\Program Files\Symantec Endpoint Protection\Bin\Symantec Security Center.exe (or equivalent agent binary) performing actions within the C:\ProgramData\Symantec\Symantec Endpoint Protection\Definitions directory.

• Scenario: Deployment of Enterprise License Keys via SCCM

  • Context: The IT Operations team uses Microsoft System Center Configuration Manager (SCCM) to push software license keys and activation tokens to workstations. When deploying the “Anorganix” licensing module for enterprise-wide applications, the deployment engine executes a script that generates temporary signed artifacts using the PseudoSigner02 certificate chain. This triggers the rule as it mimics the behavior of a new security component installation.
  • Suggested Filter/Exclusion: Exclude processes spawned by ccmsetup.exe or ccmexec.exe when they interact with files containing the extension .anx or located in the C:\Windows\CCM\Logs directory, specifically during known maintenance windows (