PseudoSigner02YodasProtector102Anorganix

Hunt Hypothesis

This rule identifies potentially malicious or obfuscated code artifacts associated with the Yodas Protector packer, which adversaries often use to disguise malware binaries and evade static analysis. Proactively hunting for these signatures in Azure Sentinel allows the SOC to detect low-severity, stealthy threats that may be embedded in user-uploaded files or web downloads before they execute and escalate privileges.

YARA Rule

rule PseudoSigner02YodasProtector102Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 00 00 00 EB 01 90 90 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses a legitimate open-source code signing utility (such as signtool.exe or osslsigncode) to sign a custom-built internal application or script during a CI/CD pipeline or local testing phase. The specific version of the tool or the resulting binary may match the structural patterns or string constants targeted by the “PseudoSigner” YARA rule, causing a false positive.

  • Filter/Exclusion: Exclude processes where the parent process is a known build agent (e.g., jenkins.exe, azureagent.exe, github-runner.exe) or where the command line contains arguments like /s (sign) or sign and the file path resides within a designated C:\Builds\ or C:\CI\ directory.

• Scenario: An IT administrator performs a routine maintenance task using a third-party digital certificate management tool (e.g., Certifier, PkiTool, or a custom internal PowerShell script) to renew or re-sign certificates for internal services. These tools often embed specific metadata or use non-standard signing algorithms that trigger the “YodasProtector” or “Anorganix” heuristic components of the rule.

  • Filter/Exclusion: Exclude events where the user account belongs to a specific security group (e.g., SG-IT-Admins or SG-Cert-Management) and the process name matches known certificate management executables (e.g., certutil.exe, pkitool.exe, or signcert.ps1).

• Scenario: A scheduled Windows Task runs a legacy internal utility (e.g., LegacySigner.exe or OldTool_v2.exe) that was developed in-house years ago and uses a non-standard or outdated signing library. This utility is triggered by the Task Scheduler (schtasks.exe or `svch