PseudoSigner02XCR011Anorganix

Hunt Hypothesis

This YARA rule targets specific binary artifacts associated with the PseudoSigner02XCR011Anorganix signature, indicating potential use of unsigned or spoofed code execution often employed by adversaries to bypass security controls. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify low-severity anomalies that may represent early-stage reconnaissance or persistent footholds before they escalate into more significant threats.

YARA Rule

rule PseudoSigner02XCR011Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 8B F0 33 DB 83 C3 01 83 C0 01 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or build engineer runs a custom Python script or PowerShell wrapper to invoke the signtool.exe utility (part of the Windows SDK) to sign a newly compiled executable or DLL before deployment. The script may use a generic certificate store or a temporary key pair, causing the binary to exhibit characteristics that match the “pseudo-signer” heuristic (e.g., missing specific timestamp fields or using a non-standard signing algorithm).

  • Filter/Exclusion: Exclude processes where the parent process is python.exe, pwsh.exe, or powershell.exe and the command line contains arguments like /s, /fd, or /p (common signtool signing flags), or restrict the rule to only trigger if the signer is not a known internal CA certificate hash.

• Scenario: An automated CI/CD pipeline agent (e.g., Jenkins, Azure DevOps, or GitHub Actions runner) executes a post-build step to sign artifacts using a self-signed or internal enterprise certificate. The agent process (often java.exe, node.exe, or a custom binary) spawns signtool.exe or a similar signing utility. The resulting signed binary may lack the full chain of trust expected by the YARA rule if the internal CA is not explicitly whitelisted in the rule’s logic.

  • Filter/Exclusion: Correlate with the process tree to exclude instances where the parent process is a known CI/CD agent (e.g., java.exe with jenkins in the command line, or node.exe with azure-devops in the path). Alternatively, add an exclusion for binaries signed by specific internal Certificate Authority (CA) thumbprints.

• Scenario: A system administrator manually signs a driver or installer package using signtool.exe from an elevated command prompt during a maintenance window. The administrator might use a test