PseudoSigner01MicrosoftVisualBasic60DLLAnorganix

Hunt Hypothesis

This hunt detects potentially malicious Visual Basic 6 DLLs that exhibit anomalous code signing patterns inconsistent with legitimate Microsoft artifacts, suggesting possible supply chain compromise or binary spoofing. Proactively hunting for these signatures in Azure Sentinel allows the SOC team to identify early-stage threats leveraging trusted signer identities to evade standard detection mechanisms before they execute within critical workloads.

YARA Rule

rule PseudoSigner01MicrosoftVisualBasic60DLLAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 68 [4] 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 5A 68 90 90 90 90 68 90 90 90 90 52 E9 90 90 FF }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PseudoSigner01MicrosoftVisualBasic60DLLAnorganix detection rule, along with targeted mitigation strategies:

• Legacy VB6 Application Deployment via Group Policy

  • Scenario: The IT Operations team deploys a legacy line-of-business application (e.g., an internal inventory tool built in Visual Basic 6.0) to 500+ workstations using Active Directory Group Policy Objects (GPO). During the deployment, the msvbvm60.dll or associated VB6 DLLs are copied and executed by the Local System account, triggering the rule due to the specific “Anorganix” signature pattern often found in older VB6 runtimes.
  • Filter/Exclusion: Create a GPO-based exclusion targeting the specific file path of the legacy application (e.g., C:\Program Files\LegacyInventory\app.exe) and exclude the hash of the known good VB6 DLLs used by this application from the YARA rule’s signature list.

• Scheduled Maintenance Job for Legacy Reporting Tool

  • Scenario: A nightly scheduled task runs a legacy reporting utility (e.g., “CrystalReports_VB6.exe”) that loads several unsigned or pseudo-signed VB6 DLLs to generate end-of-day financial reports. The job executes at 02:00 AM via Task Scheduler, causing the detection engine to flag the DLL loading process as anomalous due to the specific signature structure of the Visual Basic 6.0 runtime.
  • Filter/Exclusion: Implement a time-based exclusion window (e.g., 01:30–02:30 daily) for the specific user account running the task (e.g., DOMAIN\svc-reporting) or exclude the specific executable path (C:\Tools\Reports\CrystalReports_VB6.exe) from the rule