PseudoSigner02WatcomCCDLLAnorganix

Hunt Hypothesis

This detection identifies potentially malicious or anomalous DLL files exhibiting characteristics of pseudo-signing, specifically targeting artifacts associated with Watcom and Anorganix that may indicate supply chain compromise or code injection attempts. A proactive hunt is essential in Azure Sentinel to uncover stealthy adversaries leveraging these specific signing patterns to bypass standard trust mechanisms before they establish persistence within the environment.

YARA Rule

rule PseudoSigner02WatcomCCDLLAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PseudoSigner02WatcomCCDLLAnorganix detection rule, including suggested filters and exclusions:

• Scenario: Legitimate deployment of legacy industrial control software (e.g., Siemens WinCC or Rockwell Automation) where the installer extracts a WatcomC.dll component that lacks a full digital signature chain but uses a pseudo-signature for internal validation.

  • Filter/Exclusion: Create an exclusion based on the file path containing specific vendor folders (e.g., C:\Program Files\Siemens\WinCC\*) and allow files where the publisher matches “Siemens AG” or “Rockwell Automation,” even if the signature type is marked as pseudo.

• Scenario: Scheduled nightly backup jobs utilizing enterprise backup agents (such as Veeam Backup & Replication or Commvault) that temporarily instantiate a Watcom C++ DLL during the indexing phase of large database files, triggering the rule due to rapid file creation and lack of persistent signing metadata in the temporary cache.

  • Filter/Exclusion: Exclude processes running under the service accounts VeeamBackupService or CommServe when accessing paths within the backup agent’s working directory (e.g., C:\ProgramData\Veeam\Backup*), specifically filtering for file extensions .dll created during maintenance windows.

• Scenario: Execution of third-party antivirus heuristic scans (e.g., CrowdStrike Falcon or McAfee Enterprise) that inject a Watcom-based DLL into the memory space of critical system processes to perform real-time code integrity checks, which the YARA rule misinterprets as an anomalous unsigned injection.

  • Filter/Exclusion: Add a whitelist for parent process names including FalconSensor.exe, McAfeeHostAgent.exe, and TamperProtect.exe, ensuring that any child processes or