PseudoSigner02WATCOMCCEXEAnorganix

Hunt Hypothesis

This YARA rule identifies executable files compiled with Watcom C/C++ that exhibit characteristics of the PseudoSigner02 tool, often used to create unsigned or pseudo-signed binaries to evade basic security checks. Proactively hunting for these artifacts in Azure Sentinel allows the SOC team to detect potential low-severity malware or trojans that may be leveraging this specific compiler signature to blend in with legitimate software or bypass initial signature-based detections.

YARA Rule

rule PseudoSigner02WATCOMCCEXEAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 00 00 00 00 90 90 90 90 57 41 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy WATCOM C Compiler Artifacts in Build Pipelines: In environments maintaining legacy C/C++ codebases compiled with the WATCOM C compiler (common in embedded systems or older enterprise applications), the resulting .exe files often retain specific compiler strings or section headers that match the WATCOMC signature. If these binaries are deployed via CI/CD pipelines (e.g., Jenkins, Azure DevOps) to application servers, they may trigger the rule if the detection logic flags the compiler metadata rather than a known pseudo-signing certificate.

  • Filter/Exclusion: Exclude files located in standard build artifact directories (e.g., C:\Builds\, /opt/builds/) or exclude processes initiated by build service accounts (e.g., svc-jenkins, svc-ci-cd) when the executable path contains watcom or wcc in the filename or parent directory.

• Third-Party Embedded WATCOM Binaries in Vendor Software: Many enterprise applications (such as older versions of database tools, network monitoring agents, or legacy ERP systems) embed small utility executables compiled with WATCOM C for performance or licensing reasons. These binaries are often placed in vendor-specific directories (e.g., C:\Program Files\VendorApp\bin\) and are executed by scheduled tasks or service wrappers.

  • Filter/Exclusion: Create an allowlist for known vendor application directories (e.g., C:\Program Files\*VendorName*\) and exclude executables whose parent process is a known vendor service (e.g., vendoragent.exe, dbmanager.exe).

• Scheduled Maintenance Jobs Using WATCOM-Compiled Utilities: Enterprise maintenance scripts (e.g., disk cleanup, log rotation, or backup verification) may invoke small, WATCOM-compiled utility executables (e.g., clean.exe, verify.exe) that