PseudoSigner02ZCode101Anorganix

Hunt Hypothesis

This YARA rule targets specific code patterns associated with the “PseudoSigner02ZCode101Anorganix” signature, likely indicating the presence of a known malware family or obfuscated payload within memory or disk artifacts. Proactively hunting for this indicator in Azure Sentinel allows the SOC to identify low-severity threats that may serve as initial footholds or persistence mechanisms before they escalate to more impactful adversary actions.

YARA Rule

rule PseudoSigner02ZCode101Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legitimate Code Signing Certificate Renewal/Rotation: When IT security teams rotate or renew code signing certificates for internal build pipelines or application deployment scripts, the new certificate or the signing tool itself (e.g., signtool.exe or osslsigncode) may be temporarily stored in a non-standard location or have a modified metadata header that matches the “PseudoSigner” heuristic.

  • Filter/Exclusion: Exclude files located in specific build agent directories (e.g., C:\Program Files\Azure DevOps\Agent\) or files with a specific ProductVersion string matching the internal build tool suite (e.g., InternalBuildTool v2.x).

• Third-Party Software Update Services: Automated update mechanisms for enterprise software (e.g., Adobe Creative Cloud, JetBrains Toolbox, or VMware Horizon Client) often download and execute temporary installer binaries or patch files in user profile temp directories (%LOCALAPPDATA%\Temp or %TEMP%). These binaries are signed by the vendor but may lack the full chain of trust or have a generic “Pseudo” signer name in their metadata due to intermediate certificate usage.

  • Filter/Exclusion: Exclude executables with a CompanyName matching known vendors (e.g., “Adobe Inc.”, “JetBrains s.r.o.”, “VMware, Inc.”) and a FileDescription containing “Installer” or “Updater”, specifically when located in user temp paths.

• Internal Test Harnesses and QA Environments: Quality Assurance (QA) engineers frequently deploy custom test harnesses or mock services for load testing or integration testing. These are often signed with an internal “QA-Test” certificate or a self-signed certificate for local verification, which may be flagged as a “PseudoSigner” if the certificate chain is not fully trusted by the endpoint agent or if the signer name is generic (e.g., “QA-