Obsidium1300ObsidiumSoftware

Hunt Hypothesis

This detection identifies the presence of Obsidium software components within the environment to establish a baseline for legitimate application behavior and potential supply chain risks. Proactive hunting is essential in Azure Sentinel to distinguish these known benign processes from anomalous activity that could indicate unauthorized deployment or early-stage compromise leveraging trusted software identities.

YARA Rule

rule Obsidium1300ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 04 [4] E8 29 00 00 00 EB 02 [2] EB 01 ?? 8B 54 24 0C EB 02 [2] 83 82 B8 00 00 00 22 EB 02 [2] 33 C0 EB 04 [4] C3 EB 04 [4] EB 04 [4] 64 67 FF 36 00 00 EB 04 [4] 64 67 89 26 00 00 EB 04 [4] EB 01 ?? 50 EB 03 [3] 33 C0 EB 02 [2] 8B 00 EB 01 ?? C3 EB 04 [4] E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 02 [2] EB 03 [3] 58 EB 04 [4] EB 01 ?? 64 67 8F 06 00 00 EB 02 [2] 83 C4 04 EB 02 [2] E8 47 26 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Obsidium1300ObsidiumSoftware detection rule, including context and recommended filtering strategies:

• Scenario: Scheduled Antivirus Definition Updates

  • Context: The Obsidium software agent often runs a background job to fetch the latest threat intelligence signatures from the central management server. This process executes as a scheduled task (e.g., ObsidiumUpdateService) during off-peak hours, triggering the rule due to network connectivity and file system access patterns that mimic initial deployment or suspicious activity.
  • Filter/Exclusion: Exclude processes where the executable path matches C:\Program Files\Obsidium\bin\ObsidiumUpdater.exe and the command line contains arguments related to “definition sync” or specific update server FQDNs (e.g., --update-source=obsidium-cdn.corp.local).

• Scenario: Enterprise Endpoint Deployment via SCCM/Intune

  • Context: During a mass rollout of the Obsidium agent across new workstations, System Center Configuration Manager (SCCM) or Microsoft Intune pushes the installation package. The installation wizard and background services launch multiple child processes that interact with the registry and local storage, which the YARA rule interprets as a potential lateral movement attempt by an unknown software entity.
  • Filter/Exclusion: Create an exclusion for process trees where the parent process is ccmexec.exe (SCCM) or Microsoft.IntuneManagementAgent.exe, specifically when the child process name contains “Obsidium” and the user context is a system account (e.g., NT AUTHORITY\SYSTEM).

• Scenario: Automated Backup and Archiving Jobs

  • Context: The Obsidium software integrates with enterprise backup solutions like Veeam or Commvault to archive local logs. When these tools initiate a backup job, they invoke the