PseudoSigner02FSG131Anorganix

Hunt Hypothesis

This detection identifies potentially malicious or suspicious executables matching the specific “PseudoSigner02FSG131Anorganix” signature pattern, which may indicate adversaries utilizing obfuscated code to evade standard security controls. Proactively hunting for this behavior in Azure Sentinel is essential to uncover stealthy threats that leverage pseudo-signing techniques to blend with legitimate traffic and maintain persistence within the environment.

YARA Rule

rule PseudoSigner02FSG131Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PseudoSigner02FSG131Anorganix detection rule, along with targeted filters and exclusions:

• Scenario: Automated Patch Deployment via SCCM/Intune

  • Context: During scheduled maintenance windows, System Center Configuration Manager (SCCM) or Microsoft Intune pushes cumulative updates to endpoints. The update installer (Microsoft.Update.Client.exe or wsappx) often triggers the YARA rule because it utilizes a pseudo-signature mechanism similar to the target threat when writing temporary files to %TEMP%.
  • Filter/Exclusion: Exclude processes where the ParentImageName is ccmsetup.exe, Microsoft.IntuneManagementExtension.exe, or wsappx.exe AND the process path contains \Windows\SoftwareDistribution\ or \Program Files (x86)\Microsoft Intune Management Extension\.

• Scenario: Antivirus Real-Time Scanning of Compressed Archives

  • Context: Enterprise antivirus solutions like CrowdStrike Falcon or SentinelOne frequently extract and scan .zip or .7z archives received via email or shared drives. The extraction utility often generates temporary pseudo-signed artifacts that mimic the detection logic’s signature for Anorganix.
  • Filter/Exclusion: Create a filter to ignore alerts where the ProcessName matches known AV components (e.g., C:\Program Files\CrowdStrike\csagent.exe, SentinelOne\ssg.exe) and the file extension of the detected object is .tmp, .zip, or .7z.

• Scenario: SQL Server Backup Jobs with Pseudo-Signing

  • Context: Scheduled nightly jobs using Microsoft SQL Server Agent (sqlagent.exe) often invoke backup scripts that generate temporary staging files. These scripts may use a custom signing library that