Obsidium13017Obsidiumsoftware

Hunt Hypothesis

This hunt hypothesis targets the execution or presence of Obsidium software components to identify potential legitimate business applications that may be leveraged by adversaries for persistence or data exfiltration. A proactive search in Azure Sentinel is recommended to establish a baseline of this software’s normal behavior, ensuring that any anomalous usage patterns or unexpected deployments are quickly distinguished from routine operations.

YARA Rule

rule Obsidium13017Obsidiumsoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 [2] E8 28 00 00 00 EB 04 [4] EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 [2] 33 C0 EB 03 [3] C3 EB 03 [3] EB 02 [2] 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 [3] EB 04 [4] 50 EB 04 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Obsidium13017Obsidiumsoftware detection rule, including context and recommended filters:

• Scenario: Scheduled Endpoint Protection Updates

  • Context: The Obsidium software agent performs daily signature database updates via a scheduled task (e.g., Task Scheduler running obsidium_update_service.exe). This process often spawns child processes that match the YARA rule’s heuristic for new executable creation or network connection patterns, triggering an alert during the 02:00 AM maintenance window.
  • Filter/Exclusion: Exclude alerts where the parent process is Task Scheduler (svchost.exe with specific image path) and the execution time falls between 01:30 and 04:30 on weekdays. Alternatively, add a whitelist entry for the Obsidium update service binary hash.

• Scenario: Admin Deployment via Configuration Management Tools

  • Context: During monthly patch cycles, administrators use tools like Microsoft SCCM (Configuration Manager) or Ansible to push new Obsidium configuration profiles or agent upgrades to a batch of workstations. The deployment engine creates temporary log files and spawns the Obsidium installer, which mimics the behavior pattern detected by rule 13017.
  • Filter/Exclusion: Filter out events where the initiating process is ccmexec.exe (SCCM) or ansible-runner.exe, specifically when the command line arguments contain keywords like “install,” “upgrade,” or “config-deploy.”

• Scenario: Automated Backup and Archiving Jobs

  • Context: Enterprise backup solutions such as Veeam Backup & Replication or Commvault often integrate with Obsidium to ensure the agent is active during data protection cycles. The backup engine may launch a helper process that invokes Obsidium’s scanning module