PseudoSigner02CodeSafe20Anorganix

Hunt Hypothesis

This rule identifies potentially malicious code artifacts associated with the PseudoSigner02CodeSafe20Anorganix signature, which may indicate the presence of unsigned or spoofed binaries used to evade detection. Proactively hunting for these indicators in Azure Sentinel helps identify low-severity threats that could serve as initial footholds for adversaries leveraging code signing anomalies to execute payloads within the environment.

YARA Rule

rule PseudoSigner02CodeSafe20Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or operations engineer uses CodeSafe (a code signing utility) to sign a custom internal build artifact or a temporary diagnostic script before deploying it to a staging environment. The tool generates a signed binary that matches the PseudoSigner02CodeSafe20Anorganix YARA pattern, triggering the alert on the build server or the developer’s workstation.

  • Filter/Exclusion: Exclude alerts where the process name is codesafe.exe or signcode.exe and the parent process is a build tool (e.g., msbuild.exe, dotnet.exe, npm.exe) or an IDE (e.g., devenv.exe, code.exe). Additionally, whitelist the specific hash of the known-good CodeSafe utility if the YARA rule is overly broad.

• Scenario: An IT administrator runs a scheduled PowerShell job using Anorganix (a hypothetical or internal naming convention for a specific security patching or configuration management agent) to apply a security update or verify code integrity on a fleet of Windows servers. The agent’s executable or its helper DLLs match the YARA signature during the execution of the scheduled task.

  • Filter/Exclusion: Exclude alerts originating from the Task Scheduler service (svchost.exe with Tasks parameter) where the command line contains Anorganix or the specific agent name. Alternatively, whitelist the specific executable path (e.g., C:\Program Files\Anorganix\Agent\anorganix_agent.exe) if the YARA rule targets the binary itself.

• Scenario: A security team performs a manual test of their code signing pipeline using a pseudo-signer utility (a tool that mimics real signing without a certificate) to validate that their detection rules work correctly. This test is run on a dedicated jump host or CI/CD runner,