PseudoSigner02BJFNT12Anorganix

Hunt Hypothesis

This detection identifies potential adversary activity involving suspicious code signing patterns or obfuscated binaries that match the specific “PseudoSigner02BJFNT12Anorganix” signature, which may indicate an attempt to bypass standard trust mechanisms using non-standard or compromised certificates. A proactive hunt is essential in Azure Sentinel to validate these low-severity alerts against known good baselines and uncover stealthy threats that might otherwise evade automated detection due to their subtle deviation from normal signing behaviors.

YARA Rule

rule PseudoSigner02BJFNT12Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PseudoSigner02BJFNT12Anorganix detection rule, along with recommended filters and exclusions:

• Scenario: Automated deployment of Microsoft Office updates via SCCM (System Center Configuration Manager) triggers the YARA rule because the update installer package contains a nested signed component matching the “PseudoSigner” signature pattern.

  • Filter/Exclusion: Create an exclusion for processes running under the ccmsetup.exe or msiexec.exe parent process where the command line includes /quiet and the file path resides within C:\Windows\CCM\.

• Scenario: The nightly execution of a custom PowerShell script (UpdateCheck.ps1) used by the IT operations team to validate certificate chains invokes a legacy utility that utilizes the specific signing certificate identified in the rule.

  • Filter/Exclusion: Exclude events where the ProcessName is powershell.exe, the CommandLine contains -ExecutionPolicy Bypass, and the file path matches C:\Scripts\IT_Ops\UpdateCheck.ps1.

• Scenario: The scheduled job for the enterprise antivirus solution (e.g., CrowdStrike Falcon or Microsoft Defender) performs a signature database update, temporarily loading a module that mimics the “Anorganix” signer structure during the ingestion phase.

  • Filter/Exclusion: Exclude alerts where the parent process is C:\Program Files\CrowdStrike\FalconSensor\csfalcon.exe (or equivalent for Defender) and the event timestamp falls within the defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: A developer running a local build environment using Docker Desktop generates container images that include a dependency library signed with the “PseudoSigner” certificate, triggering the rule during image pull