Obsidium13021ObsidiumSoftware

Hunt Hypothesis

This detection identifies the presence of Obsidium software components within the environment by leveraging a specific YARA signature to flag known legitimate applications. SOC teams should proactively hunt for this signal in Azure Sentinel to establish a baseline of trusted software behavior and distinguish it from potential masquerading threats that mimic similar file characteristics.

YARA Rule

rule Obsidium13021ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 03 [3] E8 2E 00 00 00 EB 04 [4] EB 04 [4] 8B 54 24 0C EB 04 [4] 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 04 [4] C3 EB 03 [3] EB 02 [2] 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 [2] EB 02 [2] 50 EB 01 ?? 33 C0 EB 03 [3] 8B 00 EB 03 [3] C3 EB 03 [3] E9 FA 00 00 00 EB 04 [4] E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 [4] EB 04 [4] 64 67 8F 06 00 00 EB 03 [3] 83 C4 04 EB 04 [4] E8 2B 26 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Obsidium13021ObsidiumSoftware detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Endpoint Protection Updates via Obsidium Agent

  • Context: The Obsidium Security Agent runs a scheduled task (e.g., ObsidiumUpdateService) every morning at 06:00 AM to download and install the latest definition updates. This process often spawns child processes that match the YARA signature, triggering alerts during the maintenance window despite being legitimate.
  • Filter/Exclusion: Configure a time-based exclusion for the rule between 05:30 and 07:30 on weekdays (Monday–Friday). Alternatively, add an exclusion based on the parent process name ObsidiumAgent.exe running under the context of the specific scheduled task ID S-1-5-21-...-ObsidiumUpdate.

• Scenario: Deployment of Obsidium Software via SCCM/Intune

  • Context: During a quarterly patching cycle, the IT team uses Microsoft Endpoint Configuration Manager (SCCM) or Intune to push new versions of Obsidium software across 500+ workstations. The installation service (ObsidiumInstaller.msi) executes the binary that triggers the rule on every affected machine simultaneously.
  • Filter/Exclusion: Create a process exclusion for msiexec.exe when its command line contains arguments referencing the Obsidium product code (e.g., /qn /l*v log.txt ObsidiumSetup.msi). Additionally, exclude alerts originating from the specific “Patch Management” computer group in your SIEM.

• Scenario: Automated Backup and Migration Jobs

  • Context: The enterprise utilizes Veeam or Commvault for nightly backups. These tools often invoke Obsidium software components to encrypt data streams before transmission