PseudoSigner01MicrosoftVisualC50MFCAnorganix

Hunt Hypothesis

This rule identifies executable files that mimic legitimate Microsoft Visual C++ 5.0 MFC binaries, a technique often used by adversaries to bypass signature-based detection or establish a foothold through trusted code execution. Proactively hunting for these pseudo-signed artifacts in Azure Sentinel helps uncover low-severity initial access or persistence mechanisms that may evade standard threshold-based alerts.

YARA Rule

rule PseudoSigner01MicrosoftVisualC50MFCAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 [4] 68 [4] 64 A1 00 00 00 00 50 E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy MFC Application Deployment via Group Policy

  • Scenario: An IT administrator pushes a legacy internal line-of-business application (built with Visual C++ 5.0 MFC) to a fleet of workstations using Group Policy Software Installation. The installer executable or the main binary itself may lack a modern Authenticode signature or use a pseudo-signature from the old “Microsoft Visual C++ 5.0 MFC” chain, triggering the rule during the mass copy/execution phase.
  • Filter/Exclusion: Exclude processes where the parent process is gpupdate.exe or gpedit.msc, or exclude files located in the standard C:\Windows\Installer\ or C:\Program Files\ directories if the file hash matches a known baseline for that specific legacy app.

• Scheduled Maintenance Job for Legacy Reporting Tool

  • Scenario: A nightly scheduled task (Task Scheduler) runs a custom reporting utility written in VC++ 5.0 MFC that generates PDF reports for finance. The executable is stored in a network share or local temp directory and is executed by svchost.exe (Task Scheduler service) or explorer.exe (if user-triggered). The binary may carry the pseudo-signature due to its age and lack of re-signing.
  • Filter/Exclusion: Exclude executions where the parent process is svchost.exe and the command line contains the specific task name (e.g., FinanceReportGen.exe), or exclude files with a specific SHA256 hash that is whitelisted in the asset inventory.

• Development Environment Build/Run Cycle

  • Scenario: A developer on a build server or dev workstation compiles a legacy MFC module using an older version of Visual Studio (or a standalone compiler) and immediately runs the resulting .exe for unit testing