PseudoSigner02CrunchPEHeuristicAnorganix

Hunt Hypothesis

This rule identifies PE files exhibiting heuristic characteristics associated with the PseudoSigner tool, which adversaries use to create fake digital signatures to bypass security controls and establish trusted execution contexts. Proactively hunting for these artifacts in Azure Sentinel allows the SOC team to uncover potentially compromised workloads or staging environments where attackers are leveraging forged signatures to evade detection before lateral movement or payload execution occurs.

YARA Rule

rule PseudoSigner02CrunchPEHeuristicAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD [4] 2B 85 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of the Anorganix (or similar PE packing/compression) utility by a DevOps engineer to optimize build artifacts for deployment.
  • Filter/Exclusion: Allow execution if the parent process is a recognized build tool (e.g., msbuild.exe, dotnet.exe, npm.exe, or java.exe) and the file path contains /build/, /dist/, or /artifacts/.
• Scenario: A scheduled maintenance job using 7-Zip or WinRAR to compress large log archives or backup sets, where the heuristic misidentifies the compressed PE header structure.
  • Filter/Exclusion: Exclude processes where the command line arguments contain -a (archive), -p (password), or -m (method) and the parent process is 7z.exe, WinRAR.exe, or tar.exe.
• Scenario: Installation or update of third-party enterprise software (e.g., Adobe Creative Cloud, VMware Tools, or Citrix Receiver) that uses custom PE packers to reduce installer size.
  • Filter/Exclusion: Allow if the file has a valid digital signature from a trusted publisher (e.g., Adobe Systems, VMware, Inc., Citrix Systems) and the signer certificate chain is valid.
• Scenario: Execution of a legitimate custom internal tool compiled with a specific linker optimization flag that results in a non-standard PE section layout, triggering the “Crunch” heuristic.
  • Filter/Exclusion: Create a whitelist for specific known internal binaries by SHA256 hash or by matching the file path to a designated C:\InternalTools\ directory.
• Scenario: Antivirus or EDR software performing a real-time scan or memory dump analysis on a PE file, where the