PseudoSigner01VOBProtectCD5Anorganix

Hunt Hypothesis

This detection identifies potential file integrity tampering or obfuscation attempts by monitoring for specific pseudo-signing artifacts associated with VOB Protect and Anorganix patterns within the Azure Sentinel environment. Proactive hunting is essential to uncover stealthy adversary behaviors that may bypass standard signature-based defenses, ensuring early identification of modified executables that could indicate supply chain compromises or living-off-the-land tactics.

YARA Rule

rule PseudoSigner01VOBProtectCD5Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 36 3E 26 8A C0 60 E8 00 00 00 00 E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the PseudoSigner01VOBProtectCD5Anorganix detection rule, along with recommended filters and exclusions:

• Scenario: Enterprise Antivirus Real-Time Scanning of Signed Binaries

  • Context: The YARA rule may flag legitimate processes when the enterprise antivirus (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) performs real-time signature verification on a newly deployed application. If the application uses a certificate chain that includes “Anorganix” or similar pseudo-signer attributes in its metadata, the scanner’s internal signing engine might trigger this rule during file access events.
  • Filter/Exclusion: Create an exclusion for the AV service process (e.g., falcon.sys, ssdt.exe) specifically when accessing files within the C:\Program Files\ directory that possess a valid Extended Validation (EV) certificate chain matching the rule’s signature hash.

• Scenario: Scheduled Software Deployment via SCCM/Intune

  • Context: During off-hours, Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune pushes silent updates to workstations. If the deployment package includes a component signed by a vendor utilizing the “VOBProtect” technology stack (often seen in specialized security or virtualization tools), the installation service (TrustedInstaller or msiexec.exe) will generate file system events that match the rule’s logic for pseudo-signers.
  • Filter/Exclusion: Exclude alerts where the parent process is ccmsetup.exe (SCCM) or IntuneManagementExtension.exe, and the target file path contains \AppData\Local\Microsoft\WindowsApps\. Additionally, filter based on a time window (e.g., 02:00 – 06:00 local