PseudoSigner01CodeSafe20Anorganix

Hunt Hypothesis

This detection identifies potentially malicious executables that utilize a specific code signing certificate pattern associated with the “PseudoSigner01CodeSafe20Anorganix” YARA signature, which may indicate an adversary leveraging trusted or spoofed digital signatures to evade initial security controls. Proactively hunting for this behavior in Azure Sentinel is essential to uncover stealthy threats that bypass standard signature-based defenses by masquerading as legitimate software through the use of known or compromised signing identities.

YARA Rule

rule PseudoSigner01CodeSafe20Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the PseudoSigner01CodeSafe20Anorganix detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Antivirus Engine Updates via Microsoft Endpoint Configuration Manager (MECM)

  • Context: During nightly maintenance windows, MECM pushes updated definition signatures to the C:\Program Files\Microsoft Defender directory. The update installer executable often utilizes a generic code signing certificate that matches the “PseudoSigner01” signature pattern but is not the specific Anorganix vendor context expected by the rule.
  • Suggested Filter/Exclusion: Add an exclusion for processes running under the Microsoft-Windows-Update service account (NT SERVICE\TrustedInstaller) executing within the path C:\Program Files (x86)\Microsoft Endpoint Manager\. Alternatively, filter out events where the parent process is ccmexec.exe and the file hash matches known Microsoft update signatures.

• Scenario: Automated Backup Jobs Executed by Veeam Backup & Replication

  • Context: The Veeam agent service (Veeam.Backup.Service) performs daily incremental backups of critical SQL databases. During the snapshot creation phase, it spawns temporary helper processes that are signed with a generic enterprise root certificate (often mimicking the “CodeSafe20” structure) to ensure integrity during data transfer, triggering the rule despite being legitimate infrastructure activity.
  • Suggested Filter/Exclusion: Create an exclusion for process names containing Veeam.Backup.Service.exe or vbragent64.exe. Additionally, filter alerts where the command line contains arguments related to --snapshot-mode or specific backup job IDs (e.g., JobID=...) known in the enterprise inventory.

• **Scenario: Deployment of Internal CI/CD Artifacts via Jenkins Pipeline