PseudoSigner 01 Microsoft Visual Cpp 70 DLL

Hunt Hypothesis

This rule identifies suspicious DLLs that masquerade as legitimate Microsoft Visual C++ 7.0 components, a technique often used by adversaries to bypass signature-based detection and establish persistence or execute malicious code. Proactively hunting for these pseudo-signed binaries in Azure Sentinel helps uncover stealthy implantation or living-off-the-land tactics that may otherwise evade standard integrity checks.

YARA Rule

rule _PseudoSigner_01_Microsoft_Visual_Cpp_70_DLL: PEiD
{
    strings:
        $a = { 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 ?? ?? ?? ?? E9 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Legacy .NET 2.0/3.5 Application Deployment via GPO or SCCM

  • Description: Enterprise environments often maintain legacy line-of-business (LOB) applications built with Visual C++ 7.0 (VS 2003) or early .NET Frameworks. When these applications are deployed or updated via Group Policy Objects (GPO) or System Center Configuration Manager (SCCM), the installer or update package may include DLLs compiled with the Microsoft Visual C++ 7.0 signature. If the deployment mechanism uses a generic or unsigned wrapper, or if the digital signature is stripped during the compression/extraction phase, the resulting DLL on disk may appear as a “pseudo-signed” artifact matching the YARA pattern.
  • Filter/Exclusion: Exclude files located in specific legacy application directories (e.g., C:\Program Files\LegacyApp\bin\) or exclude processes initiated by gpupdate.exe, ccmsetup.exe, or SCCMClient service accounts. Additionally, whitelist known legacy application paths if the rule triggers on static file analysis.

• Scenario: Development and Testing Environments with Local Build Artifacts

  • Description: In development or QA environments, engineers frequently build C++ projects using older toolchains for compatibility testing. If a developer compiles a DLL using the Visual C++ 7.0 toolset (or a compatible compiler) and copies it to a shared network drive or test server without re-signing it with a modern certificate, the file will retain the legacy compiler signature. If the YARA rule is applied to file systems on dev/test servers, these legitimate build artifacts will trigger the detection.
  • Filter/Exclusion: Exclude hosts tagged as Dev, QA, or Test in the CMDB. Alternatively, exclude file paths under common development directories such as `C:\Users