PseudoSigner 02 MinGW GCC 2x Anorganix

Hunt Hypothesis

This rule identifies malicious binaries compiled with MinGW GCC that exhibit specific Anorganix patterns, a technique often used by threat actors to create lightweight, unsigned executables for initial access or payload delivery. Proactively hunting for these artifacts in Azure Sentinel allows the SOC to detect low-fidelity malware that may evade traditional signature-based detection, particularly in environments where developers or attackers utilize cross-platform compilation tools to blend in with legitimate build outputs.

YARA Rule

rule _PseudoSigner_02_MinGW_GCC_2x_Anorganix: PEiD
{
    strings:
        $a = { 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer compiles a native C/C++ utility using the MinGW-w64 GCC toolchain on a build server or developer workstation, resulting in an executable that lacks a valid Authenticode signature but retains specific GCC metadata strings.
  • Filter/Exclusion: Exclude files located in standard development directories (e.g., C:\dev\, C:\builds\, C:\workspace\) or files owned by known developer service accounts. Additionally, exclude if the file path contains minGW or gcc in the directory structure.
• Scenario: An IT administrator installs a legacy or open-source CLI tool (e.g., 7zip, curl, or custom internal scripts) that was compiled with MinGW GCC for Windows compatibility, often distributed as a standalone .exe without a commercial code-signing certificate.
  • Filter/Exclusion: Maintain a whitelist of known legitimate MinGW-compiled binaries by their SHA256 hash or specific file names (e.g., 7z.exe, curl.exe). Alternatively, exclude if the parent process is a known installer (e.g., msiexec.exe, setup.exe) or if the file is located in C:\Program Files\ or C:\Program Files (x86)\ and the parent process is an authorized admin tool.
• Scenario: A scheduled maintenance job or backup agent (e.g., Veeam, Commvault, or a custom PowerShell script invoking a C++ helper) executes a MinGW-compiled helper binary to perform disk operations or log parsing.
  • Filter/Exclusion: Exclude if the parent process is a known backup or monitoring agent (e.g., VeeamBackup.exe, commvault.exe, nagios.exe). Also, consider excluding if the file is located in C:\ProgramData\ or