PseudoSigner 01 Stelth PE 101

Hunt Hypothesis

This hypothesis targets the presence of the PseudoSigner 01 Stealth PE 101 YARA signature, which indicates an adversary is using a specific variant of the PseudoSigner tool to create or manipulate Portable Executables, often to bypass signature verification or hide malicious code. Proactively hunting for this indicator in Azure Sentinel allows the SOC team to identify low-severity, stealthy implantations early, preventing potential privilege escalation or persistence mechanisms that might otherwise go unnoticed due to their low initial severity rating.

YARA Rule

rule _PseudoSigner_01_Stelth_PE_101: PEiD
{
    strings:
        $a = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 BA ?? ?? ?? ?? FF E2 BA E0 10 40 00 B8 68 24 1A 40 89 02 83 C2 03 B8 40 00 E8 EE 89 02 83 C2 FD FF E2 2D 3D 5B 20 48 69 64 65 50 45 20 5D 3D 2D 90 00 00 00 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses a legitimate open-source PE header manipulation tool (e.g., pefix or a custom Python script using pefile) to strip or modify the Characteristics field in a binary to remove the IMAGE_FILE_EXECUTABLE_IMAGE flag during a test build or for a specific embedded firmware component.

  • Filter/Exclusion: Exclude files located in specific development directories (e.g., C:\Dev\Projects\, C:\Users\*\AppData\Local\Temp\builds\) or exclude processes with command lines containing pefix, python, or pefile when the target file extension is .bin, .fw, or .obj rather than standard .exe/.dll.

• Scenario: A scheduled maintenance job runs a third-party installer or updater (e.g., 7-Zip, WinRAR, or a vendor-specific agent like CrowdStrike or Carbon Black) that temporarily creates a PE file in a temporary directory with non-standard header flags to support a specific compression or encryption feature before finalizing the executable.

  • Filter/Exclusion: Exclude files created by known installer processes (e.g., msiexec.exe, setup.exe, install.exe) or files located in standard temporary directories (%TEMP%, C:\Windows\Temp) that are older than 5 minutes, as these are often transient artifacts of legitimate installation routines.

• Scenario: A security team performs a “canary” or honeypot deployment where a known benign executable is intentionally modified to have a “stealth” PE header to test detection coverage across the environment, or a legacy application is patched by a vendor tool that alters the PE header to bypass a specific OS check.

  • Filter/Exclusion: Exclude files with specific known hashes (SHA2