PseudoSigner01Neolite20Anorganix

Hunt Hypothesis

This rule detects the presence of the PseudoSigner01Neolite20Anorganix YARA signature, which identifies malicious or suspicious code artifacts often associated with specific threat actor tooling or obfuscated payloads. Proactively hunting for this indicator in Azure Sentinel allows the SOC to identify compromised endpoints or persistent threats before they escalate, leveraging low-severity detections to uncover stealthy adversary activity that may bypass higher-priority alerts.

YARA Rule

rule PseudoSigner01Neolite20Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer runs a local build script using CMake or Ninja to compile a C++ project that includes a custom, unsigned, or self-signed helper binary (e.g., libanorganix_helper.dll) for testing purposes before the final code signing step.

  • Filter/Exclusion: Exclude files located in standard development directories (e.g., C:\Users\*\source\*, C:\dev\*, or C:\build\*) and exclude processes spawned by cmake.exe, ninja.exe, or msbuild.exe.

• Scenario: An IT administrator deploys a legacy internal tool or a patched version of a third-party application (e.g., a custom wrapper for Adobe Reader or an internal Java-based utility) that has been re-signed with a corporate internal certificate or has a corrupted/missing Authenticode signature due to a recent patching cycle.

  • Filter/Exclusion: Exclude binaries whose file path contains keywords like \patched\, \internal-tools\, or \legacy\, and exclude files where the LastWriteTime is within the last 24 hours (indicating recent deployment/patching activity).

• Scenario: A security team or QA engineer runs a dynamic analysis tool like Frida or x64dbg to debug a specific application, which may inject a small, unsigned helper library or script into the target process, triggering the YARA rule on the injected module.

  • Filter/Exclusion: Exclude files loaded by processes named frida-server.exe, x64dbg.exe, or windbg.exe, and exclude paths containing \frida\ or \debugging\.

• Scenario: A scheduled task or service (e.g., a Syslog collector or