PseudoSigner 01 Microsoft Visual Basic 50 60 Anorganix

Hunt Hypothesis

This hypothesis targets the presence of executable files signed by the “PseudoSigner” certificate, a known artifact used by threat actors to bypass code signing verification and establish trust for malicious payloads. Proactively hunting for these specific signatures in Azure Sentinel allows the SOC to identify potentially compromised endpoints or staged malware before they execute, leveraging the unique combination of Visual Basic and Anorganix indicators to reduce false positives.

YARA Rule

rule PseudoSigner_01_Microsoft_Visual_Basic_50_60_Anorganix: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A legacy internal application built with Visual Basic 6.0 is updated via a Group Policy Object (GPO) or SCCM deployment. The executable is signed with a generic or expired certificate (common in older VB6 apps), and the file metadata retains the “Microsoft Visual Basic 5.0/6.0” compiler string, triggering the YARA rule due to the combination of the compiler signature and the non-standard signing state.

  • Filter/Exclusion: Exclude files located in specific application directories (e.g., C:\Program Files\LegacyApp\) or exclude executables where the PE.OptionalHeader.Subsystem is 2 (Windows GUI) and the PE.File section contains the specific compiler string Microsoft Visual Basic 5.0 or 6.0, provided the file hash is in a known-good baseline.

• Scenario: An IT administrator uses a third-party tool like NirSoft’s VB6 Decompiler or ILSpy to analyze or decompile a VB6 application for troubleshooting. The tool creates temporary .exe or .dll files in the user’s %TEMP% or %APPDATA% folder that are unsigned or pseudo-signed, retaining the original compiler metadata.

  • Filter/Exclusion: Exclude files created by processes with names like decompiler.exe, ilspy.exe, or vb6decomp.exe, or exclude files in paths containing \Temp\ or \AppData\Local\ where the parent process is a known development or analysis tool.

• Scenario: A scheduled maintenance job runs a custom VB6 script compiled to an executable to clean up logs or rotate databases. The executable is stored in a shared network drive (\\fileserver\tools\) and is signed with a self-signed certificate that has a weak key size or is not in the trusted root store, causing