Obsidium1200ObsidiumSoftware

Hunt Hypothesis

This hypothesis targets the presence of Obsidium software, a known tool often utilized by adversaries for data exfiltration or remote access, which may indicate a foothold in the environment. Proactively hunting for this signature allows the SOC team to identify potentially compromised hosts or unauthorized tooling before it is leveraged for further lateral movement or data theft.

YARA Rule

rule Obsidium1200ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 [2] E8 3F 1E 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Obsidium Software Installation or Update via MSI/EXE:

  • Scenario: An IT administrator or a GPO-driven scheduled task installs or updates the “Obsidium” software suite (e.g., a proprietary monitoring agent, backup client, or internal utility) on endpoint workstations. The installer process (msiexec.exe or a specific ObsidiumInstaller.exe) writes the binary to disk, triggering the YARA signature match.
  • Filter/Exclusion: Exclude events where the parent process is msiexec.exe or setup.exe and the file path contains \Obsidium\ or \ObsidiumSoftware\. Additionally, exclude if the file hash matches the known good SHA-256 of the current release version.

• Scheduled Maintenance or Cleanup Job:

  • Scenario: A scheduled task (e.g., ObsidiumDailyClean or ObsidiumLogRotation) runs ObsidiumService.exe or a helper script to archive logs or rotate data. If the rule matches the service executable or a temporary file created during this process, it may trigger an alert.
  • Filter/Exclusion: Exclude events where the command line contains keywords like --clean, --rotate, or --archive, or where the parent process is Task Scheduler (svchost.exe with Tasks service). Verify the file path is under the standard Obsidium data directory (e.g., C:\ProgramData\Obsidium\).

• Development or QA Testing Environment:

  • Scenario: Developers or QA engineers run the Obsidium software in a test environment or on dev laptops to validate new features or configurations. They may launch the application directly from a build directory (e.g., D:\Builds\Obsidium\bin\Debug\Obsidium.exe) rather than the standard install path.