PseudoSigner01Gleam100Anorganix

Hunt Hypothesis

This hypothesis targets the execution of malicious or obfuscated scripts that leverage the Gleam language runtime, potentially indicating an adversary using less common interpreters to evade standard script-based detections. Proactively hunting for this activity in Azure Sentinel helps identify low-severity initial access or lateral movement attempts that may slip past traditional Windows-centric monitoring by exploiting non-standard execution environments.

YARA Rule

rule PseudoSigner01Gleam100Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or IT administrator uses Gleam (a legitimate .NET code generation tool) to generate C# classes from XML or JSON schemas during a routine build process or local development task. The generated files may contain specific string patterns or structural artifacts that match the YARA rule’s signature for “Anorganix” or pseudo-signing patterns.

  • Filter/Exclusion: Exclude files located in standard development directories (e.g., C:\Users\<User>\source\repos\, C:\dev\, C:\work\) or files with extensions like .cs, .json, or .xml that are created within the last 1 hour by processes named dotnet.exe, msbuild.exe, or gleam.exe.

• Scenario: An enterprise application uses Gleam or a similar code-generation library as part of a scheduled nightly job to update API client stubs or data models. The job runs via Task Scheduler or System Center Orchestrator and writes temporary files to a shared network drive or local temp folder that matches the rule’s path or content criteria.

  • Filter/Exclusion: Exclude events where the parent process is svchost.exe (Task Scheduler service) or orchestrator.exe, and the file path contains \Temp\, \tmp\, or \build\ directories, specifically if the file age is less than 24 hours.

• Scenario: A security team or QA engineer runs a YARA scan or uses a tool like YARA-N to test detection rules against a corpus of known-good enterprise binaries. The test files, which may include intentionally crafted “pseudo-signed” samples or artifacts from the Gleam framework, are stored in a dedicated test directory and trigger the rule during the scan.

  • **Filter/Exclusion