PseudoSigner01XCR011Anorganix

Hunt Hypothesis

This detection identifies potentially malicious or obfuscated code artifacts associated with the “PseudoSigner” family, which adversaries often use to disguise their presence or execute payloads without triggering standard signature-based defenses. Proactively hunting for these indicators in Azure Sentinel allows the SOC to uncover stealthy fileless or memory-resident threats that may have bypassed initial perimeter controls, ensuring early detection of low-severity anomalies that could escalate into larger compromises.

YARA Rule

rule PseudoSigner01XCR011Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 8B F0 33 DB 83 C3 01 83 C0 01 E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer manually runs a custom-built, internally signed utility (e.g., internal-deploy-helper.exe) that was compiled with a specific version of the Anorganix signing library or toolchain, causing the binary to match the YARA pattern despite being a trusted internal artifact.

  • Filter/Exclusion: Exclude files located in specific trusted development directories (e.g., C:\Dev\InternalTools\) or add an exclusion for binaries where the Image path matches *\\InternalTools\\*.exe and the Signer is a known internal CA.

• Scenario: A scheduled maintenance job runs a legacy backup or log-rotation script (e.g., log-rotate-v1.2.exe) that was built years ago using an older version of the build system that inadvertently embedded the PseudoSigner01XCR011 signature string or byte pattern, which is now flagged as suspicious.

  • Filter/Exclusion: Create a whitelist for known legacy executables by Image name and Hash (SHA256), specifically targeting log-rotate-v1.2.exe and other identified legacy maintenance tools in the C:\ProgramData\Maintenance\ directory.

• Scenario: An IT administrator installs a new version of a third-party monitoring agent (e.g., DynatraceAgent.exe or NewRelicAgent.exe) that includes a bundled helper binary or plugin (e.g., agent-helper.dll) which uses a generic or pseudo-signing mechanism that matches the YARA rule’s byte pattern, often due to shared code libraries or build artifacts.

  • Filter/Exclusion: Exclude binaries where the Image path contains \\Agents\\ or \\Monitoring\\ and the Signer is a recognized vendor (e.g.,