PseudoSigner 01 LTC 13

Hunt Hypothesis

This rule detects the presence of PseudoSigner, a tool frequently used by adversaries to generate valid code signatures for malicious binaries, thereby evading signature-based detection mechanisms. Proactively hunting for this artifact in Azure Sentinel allows the SOC to identify potentially compromised workstations or staging environments where attackers are preparing to deploy signed malware before execution.

YARA Rule

rule _PseudoSigner_01_LTC_13: PEiD
{
    strings:
        $a = { 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or build engineer uses Visual Studio or MSBuild to compile a C++ application that includes a custom #pragma comment(linker, "/alternatename:...") directive or specific linker flags to resolve symbol conflicts, which inadvertently matches the byte pattern targeted by the YARA rule.

  • Filter/Exclusion: Exclude processes where the parent process is devenv.exe (Visual Studio) or MSBuild.exe, and the file path contains \bin\ or \obj\ directories. Additionally, filter out files with extensions .obj, .lib, or .pdb unless they are being executed directly.

• Scenario: An IT administrator runs Sysinternals sigcheck.exe or Authenticode verification tools (like signtool verify) on a large batch of legacy executables in a shared network share to audit digital signatures. The tool creates temporary memory-mapped views or intermediate files that match the pseudo-signature pattern.

  • Filter/Exclusion: Exclude alerts where the process name is sigcheck.exe, signtool.exe, or verifysignature.exe. Also, exclude file paths located in known audit directories such as C:\Temp\Audit\ or \\fileserver\IT\SignatureAudit\.

• Scenario: A scheduled task runs 7-Zip or WinRAR to extract a compressed archive containing a self-extracting executable (SFX) or a packed installer (e.g., from Inno Setup or NSIS) that uses a known packing algorithm with a specific header structure that mimics the PseudoSigner pattern.

  • Filter/Exclusion: Exclude files with extensions .exe that are located in temporary extraction directories (e.g., C:\Users\*\AppData\Local\Temp\,