PseudoSigner 01 Pack Master 10 PEX Clone Anorganix

Hunt Hypothesis

This rule detects the presence of PEX (Portable Executable) clones or packed binaries associated with the Anorganix family, indicating potential use of obfuscation techniques to hide malicious payloads from static analysis. Proactively hunting for these signatures in Azure Sentinel allows the SOC to identify compromised workstations or staging environments where adversaries are leveraging PEX packers to evade detection and establish a foothold before executing further post-exploitation actions.

YARA Rule

rule _PseudoSigner_01_Pack_Master_10_PEX_Clone_Anorganix: PEiD
{
    strings:
        $a = { 60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Development teams using PEX (PyInstaller) to package Python applications for distribution. The YARA rule likely matches the specific structure or metadata of PEX executables, which are common in CI/CD pipelines for deploying microservices or internal tools.
  • Filter/Exclusion: Exclude files located in standard build artifact directories (e.g., C:\BuildAgent\work\, D:\CI\artifacts\) or files with the extension .pex if the rule is overly broad. Alternatively, whitelist specific known-good hashes of the PEX compiler tool itself if it resides in a tools directory.
• Scenario: Legacy application maintenance where Anorganix (or a similar proprietary/obfuscated wrapper) is used to protect intellectual property in a long-standing internal line-of-business (LOB) application. This might be triggered during routine patching or when the application is copied to a new server via Robocopy or PowerShell Copy-Item.
  • Filter/Exclusion: Whitelist the specific executable path of the legacy LOB application (e.g., C:\Program Files\LegacyApp\bin\app.exe) and exclude events where the parent process is a known file transfer tool like robocopy.exe or powershell.exe performing a copy operation.
• Scenario: Automated deployment of Java/Python hybrid tools that use PEX for cross-platform compatibility, often deployed via Ansible or Chef cookbooks to application servers. The “Clone” aspect of the rule name suggests it might detect file duplication or specific memory mappings that occur during the unpacking/execution phase of these packaged tools.
  • Filter/Exclusion: Exclude processes spawned by configuration management agents (e.g., ansible-runner, chef-client) or those running from temporary extraction directories (e.g., `C:\