PseudoSigner02JDPack1xJDProtect09Anorganix

Hunt Hypothesis

This detection identifies potentially malicious executables that exhibit a specific combination of pseudo-signing and packing behaviors often associated with the JDProtect and Anorganix toolchains used by threat actors to evade static analysis. A proactive hunt is essential in Azure Sentinel because these low-severity indicators frequently represent early-stage fileless or packed malware campaigns that may bypass standard signature-based defenses, requiring deeper behavioral investigation to prevent lateral movement.

YARA Rule

rule PseudoSigner02JDPack1xJDProtect09Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the PseudoSigner02JDPack1xJDProtect09Anorganix rule, tailored for an enterprise environment:

• Scenario: Deployment of JD Edwards (JDE) EnterpriseOne patches via Microsoft System Center Configuration Manager (SCCM).

  • Context: During scheduled maintenance windows, the SCCM client service (ccmexec.exe) extracts and executes JDE patch packages on endpoint machines. These packages often contain installer binaries signed with certificates that match the “PseudoSigner” or “Anorganix” profile used by the detection logic.
  • Suggested Filter: Create an exclusion for ProcessName equal to ccmexec.exe where the CommandLine contains keywords like /install, JDEPatch, or specific JDE version strings (e.g., E1.*).

• Scenario: Execution of automated nightly data synchronization jobs using Oracle JD Edwards tools.

  • Context: The enterprise runs a scheduled task (Task Scheduler) named “JDProtectSync” that executes the JDPack utility to synchronize metadata between the central database and local workstations. This utility is often wrapped in a script that triggers the specific YARA signature due to its internal signing structure.
  • Suggested Filter: Exclude alerts where the ProcessPath matches the known installation directory of JDE tools (e.g., C:\Program Files\Oracle\JD Edwards\Tools\bin\JDPack.exe) and the ParentProcessName is svchost.exe or TaskScheduler.

• Scenario: Antivirus scanning of temporary extraction folders during software updates.

  • Context: When the enterprise’s endpoint protection suite (e.g., CrowdStrike Falcon or Symantec Endpoint Protection) scans a temporary directory (`C:\Temp\JDE_Updates