PseudoSigner 02 MinGW GCC 2x

Hunt Hypothesis

This rule identifies executable files compiled with MinGW GCC that exhibit characteristics of the PseudoSigner tool, a utility frequently used by adversaries to generate fake code-signing certificates to bypass security controls. Proactively hunting for these artifacts in Azure Sentinel allows the SOC team to detect potentially compromised binaries or malicious payloads that leverage weak or forged signatures to evade trust-based detection mechanisms.

YARA Rule

rule PseudoSigner_02_MinGW_GCC_2x: PEiD
{
    strings:
        $a = { 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer compiles a small utility or script wrapper using the MinGW-w64 GCC compiler on a Windows build server or developer workstation to create a native .exe for cross-platform testing.
  • Filter/Exclusion: Exclude files located in specific build directories (e.g., C:\Builds\, C:\Projects\) or exclude processes where the parent process is gcc.exe, g++.exe, or mingw32-make.exe.
• Scenario: An automated CI/CD pipeline (e.g., Jenkins, GitLab CI, or Azure DevOps) runs a job that compiles C/C++ code using MinGW GCC to generate artifacts for release, often occurring in a service account context or within a containerized agent.
  • Filter/Exclusion: Exclude alerts where the file path contains standard CI/CD workspace identifiers (e.g., workspace\, agent\, builds\) or where the process tree includes known CI/CD orchestrator binaries (e.g., java.exe for Jenkins, node.exe for GitLab runners).
• Scenario: A legacy application installer or a specific vendor tool (e.g., certain versions of Wireshark, GPG4Win, or older Python packages) includes a pre-compiled MinGW GCC binary that is executed during a scheduled maintenance task or software update.
  • Filter/Exclusion: Maintain a whitelist of known vendor executable paths (e.g., C:\Program Files\GPG4Win\, C:\Program Files (x86)\Wireshark\) or exclude files with a specific hash known to be the legitimate vendor binary.
• Scenario: A system administrator uses a command-line tool like cygwin or msys2 (which often bundles MinGW GCC) to compile a