Obsidium13013ObsidiumSoftware

Hunt Hypothesis

This detection identifies the presence of Obsidium software components within the environment by leveraging a specific YARA signature to flag known benign or potentially suspicious artifacts. A proactive hunt is recommended in Azure Sentinel to establish a baseline for this software’s behavior and distinguish its legitimate activity from anomalous patterns that could indicate supply chain compromise or unauthorized deployment.

YARA Rule

rule Obsidium13013ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 ?? E8 26 00 00 00 EB 02 [2] EB 02 [2] 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 [4] 33 C0 EB 02 [2] C3 EB 01 ?? EB 04 [4] 64 67 FF 36 00 00 EB 02 [2] 64 67 89 26 00 00 EB 01 ?? EB 03 [3] 50 EB 01 ?? 33 C0 EB 03 [3] 8B 00 EB 02 [2] C3 EB 02 [2] E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 03 [3] EB 02 [2] 58 EB 03 [3] EB 04 [4] 64 67 8F 06 00 00 EB 03 [3] 83 C4 04 EB 03 [3] E8 13 26 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Obsidium13013ObsidiumSoftware detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Deployment of Obsidium Endpoint Security Agents via SCCM/Intune

  • Context: During monthly patch cycles, System Center Configuration Manager (SCCM) or Microsoft Intune pushes the obsidium-agent-installer.exe to endpoints. The YARA rule triggers on the installation binary’s signature when it executes in the background.
  • Filter/Exclusion: Create an exclusion for the specific file path of the installer and the parent process.
    • Condition: Exclude events where ProcessName is obsidium-agent-installer.exe AND ParentImage contains \Microsoft\CCM\ OR \IntuneManagementExtension\.

• Scenario: Automated Backup Job Executing Obsidium Policy Synchronization

  • Context: A nightly scheduled task (Task Scheduler) runs a script to sync security policies from the central Obsidium manager to local agents. The script invokes obsidium-sync-cli.exe, which matches the YARA signature for software components.
  • Filter/Exclusion: Filter based on the specific Windows Task name and the user account running the job.
    • Condition: Exclude events where TaskName equals “Obsidium_Policy_Sync” AND UserAccount is a dedicated service account (e.g., DOMAIN\svc-obsidium-sync).

• Scenario: IT Admin Performing Manual Remediation on Workstations

  • Context: An IT administrator manually runs the Obsidium diagnostic tool (obsidium-diag.exe) from an administrative command prompt to troubleshoot a specific client machine. The rule flags this manual execution as a new software deployment event.
  • Filter/Exclusion: Exclude based on the interactive user context and