Obsidium1331ObsidiumSoftware

Hunt Hypothesis

This detection identifies the presence of Obsidium software within the environment by leveraging a specific YARA signature to confirm legitimate application deployment or potential unauthorized installation. The SOC team should proactively hunt for this indicator in Azure Sentinel to establish a baseline of known good software and quickly distinguish it from malicious impersonation attempts that may mimic similar file characteristics.

YARA Rule

rule Obsidium1331ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 ?? E8 29 00 00 00 EB 02 [2] EB 03 [3] 8B 54 24 0C EB 02 [2] 83 82 B8 00 00 00 24 EB 04 [4] 33 C0 EB 02 [2] C3 EB 02 [2] EB 02 [2] 64 67 FF 36 00 00 EB 04 [4] 64 67 89 26 00 00 EB 01 ?? EB 02 [2] 50 EB 01 ?? 33 C0 EB 04 [4] 8B 00 EB 03 [3] C3 EB 03 [3] E9 FA 00 00 00 EB 02 [2] E8 D5 FF FF FF EB 01 ?? EB 04 [4] 58 EB 02 [2] EB 04 [4] 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 02 [2] E8 5F 27 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Obsidium1331ObsidiumSoftware detection rule, including suggested filters and exclusions:

• Scenario: Automated Endpoint Protection Updates

  • Context: The Obsidium software agent performs scheduled daily signature updates via a background service (ObsidiumUpdateService.exe) running under the SYSTEM account. This process often triggers the YARA rule when downloading new threat intelligence modules.
  • Filter/Exclusion: Exclude processes where the parent image is C:\Program Files\Obsidium\Agent\Updater.exe and the user context is NT AUTHORITY\SYSTEM.

• Scenario: Enterprise Backup Agent Integration

  • Context: During nightly backup windows, Veeam or Commvault agents interact with Obsidium’s local database files to ensure data consistency. The interaction between the backup service (VeeamBackupService.exe) and Obsidium’s core engine generates file I/O patterns that match the rule’s signature.
  • Filter/Exclusion: Create a whitelist for process paths containing C:\Program Files\Obsidium\Database\ when the parent process is identified as vbrservice.exe or vcagent.exe.

• Scenario: IT Admin Manual Configuration via PowerShell

  • Context: System administrators frequently run custom PowerShell scripts to bulk-update Obsidium policies across 50+ workstations. These scripts invoke the Obsidium CLI tool (obsidium-cli.exe) with specific flags, which mimics the behavior of a potential security event.
  • Filter/Exclusion: Exclude alerts where the command line contains --mode=admin-config and the parent process is powershell.exe executed by members of the Domain Admins or Obsidium-Admins group.

• Scenario: Third-Party SIEM Data Ingestion *