PseudoSigner01NorthStarPEShrinker13Anorganix

Hunt Hypothesis

This detection identifies potentially malicious or suspicious artifacts matching the specific signature of the “PseudoSigner01NorthStarPEShrinker13Anorganix” YARA rule, which may indicate early-stage reconnaissance or the presence of a novel threat actor utilizing this unique code structure. The SOC team should proactively hunt for these occurrences in Azure Sentinel to validate false positives and uncover stealthy threats that might evade standard signature-based defenses due to their low severity classification.

YARA Rule

rule PseudoSigner01NorthStarPEShrinker13Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the detection rule PseudoSigner01NorthStarPEShrinker13Anorganix, including suggested filters and exclusions tailored for a legitimate enterprise environment:

• Scenario: Scheduled Microsoft Defender Antivirus Update Service

  • Context: The MpCmdRun.exe process (Microsoft Defender) frequently executes during off-hours to download and install the latest definition updates. This activity often involves reading and writing large signature files that match the “PseudoSigner” pattern within the YARA rule, triggering a hit on the update engine’s background threads.
  • Filter/Exclusion: Add an exclusion for the process path C:\Program Files\Windows Defender\MpCmdRun.exe where the parent process is svchost.exe (specifically the wuauserv service). Alternatively, exclude file paths under C:\ProgramData\Microsoft\Windows Defender\Updates.

• Scenario: Enterprise Backup Agent Scanning (Veeam or Commvault)

  • Context: During nightly backup windows, agents like Veeam Backup & Replication (VeeamService.exe) or Commvault (cmdAgent.exe) scan the file system to identify changed blocks. The rule may misinterpret the agent’s internal signature verification logic as a suspicious “shrinker” activity when processing large database files (.vmdk, .vhd) in shared storage locations.
  • Filter/Exclusion: Exclude processes belonging to known backup vendors (e.g., VeeamService.exe, cmdAgent.exe) running on the specific file system paths of the backup repository (e.g., D:\Backup\ or E:\DataStore\).

• Scenario: Automated Patch Deployment via SCCM/Intune

  • Context: When System Center Configuration Manager (SCCM) or