PseudoSigner 02 CodeSafe 20 Anorganix

Hunt Hypothesis

This rule detects the presence of the Anorganix PseudoSigner tool, which adversaries use to generate fake code signatures to bypass security controls and establish trusted execution contexts. Proactively hunting for this tool in Azure Sentinel allows the SOC to identify potentially compromised workloads or staging environments before the forged signatures are leveraged to execute malicious payloads or persist within the environment.

YARA Rule

rule PseudoSigner_02_CodeSafe_20_Anorganix: PEiD
{
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy .NET Application Deployment via Group Policy: When deploying legacy internal business applications (e.g., custom inventory management tools) that were compiled with older versions of the .NET Framework or specific third-party obfuscators, the binary may retain the “CodeSafe” or “Anorganix” signature artifacts. These are often legitimate commercial or internal tools that have not been recompiled with modern signing standards.

  • Filter/Exclusion: Exclude files located in specific application directories (e.g., C:\Program Files\InternalApps\) or filter by the specific executable name (e.g., InventoryManager.exe) if the hash is known and verified.

• Scheduled Backup and Archiving Jobs: Enterprise backup solutions (such as Veeam, Commvault, or Windows Server Backup) sometimes use proprietary compression or encryption wrappers that embed specific metadata strings. If the backup agent or its helper utilities are signed with a pseudo-signature or use a custom wrapper library, the resulting .bak or .vbk files (or the agent executable itself) might match the YARA pattern.

  • Filter/Exclusion: Exclude processes or files with extensions like .vbk, .bak, or .zip located in backup storage paths (e.g., D:\Backups\), or exclude the specific backup agent process name (e.g., vsqlsvr.exe, cvpp.exe).

• Third-Party Plugin or Add-on Installation: Software like Adobe Creative Suite, JetBrains IDEs, or specific ERP systems (e.g., SAP, Oracle) often install plugins or helper DLLs that are signed by smaller vendors or use custom signing certificates that may be misidentified as “pseudo-signers” by the detection logic. These are typically installed during standard software updates or feature additions.

  • Filter/Exclusion: Exclude DLLs or EXEs located in vendor-specific plugin directories (