Obsidium1333ObsidiumSoftware

Hunt Hypothesis

This detection identifies potential malicious activity from Obsidium Software by leveraging a specific YARA signature to flag known indicators of compromise within the Azure Sentinel environment. Proactively hunting for this behavior allows the SOC team to validate legitimate software usage against emerging threats and ensure early identification of any deviations that could signal an initial foothold for adversaries.

YARA Rule

rule Obsidium1333ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 [2] E8 29 00 00 00 EB 03 [3] EB 03 [3] 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 [3] 33 C0 EB 01 ?? C3 EB 04 [4] EB 02 [2] 64 67 FF 36 00 00 EB 04 [4] 64 67 89 26 00 00 EB 02 [2] EB 04 [4] 50 EB 04 }
	$a1 = { EB 02 [2] E8 29 00 00 00 EB 03 [3] EB 03 [3] 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 [3] 33 C0 EB 01 ?? C3 EB 04 [4] EB 02 [2] 64 67 FF 36 00 00 EB 04 [4] 64 67 89 26 00 00 EB 02 [2] EB 04 [4] 50 EB 04 [4] 33 C0 EB 01 ?? 8B 00 EB 03 [3] C3 EB 03 [3] E9 FA 00 00 00 EB 03 [3] E8 D5 FF FF FF EB 04 [4] EB 04 [4] 58 EB 01 ?? EB 03 [3] 64 67 8F 06 00 00 EB 04 [4] 83 C4 04 EB 04 [4] E8 2B 27 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Obsidium1333ObsidiumSoftware detection rule, including targeted filters and exclusions:

• Scenario: Scheduled Antivirus Definition Updates

  • Context: The enterprise uses CrowdStrike Falcon or Microsoft Defender for Endpoint, which runs a daily scheduled task at 02:00 AM to download and install new signature definitions. This process often spawns the obsidium.exe (or similar) utility to verify integrity before deployment, triggering the YARA rule.
  • Filter/Exclusion: Create an exclusion for the specific scheduled task name (UpdateDefTask) or exclude the file path C:\Program Files\Obsidium\Updates\ from detection if the process parent is svchost.exe (or the specific AV service).

• Scenario: Enterprise Software Deployment via SCCM/Intune

  • Context: During a monthly patching window, Microsoft Endpoint Configuration Manager (SCCM) or Intune pushes a silent installation of the Obsidium software suite to 50+ workstations. The deployment engine executes the installer binary which matches the YARA signature, causing a spike in alerts across the fleet simultaneously.
  • Filter/Exclusion: Filter out events where the process command line contains /quiet or MSIEXEC, and restrict the rule to trigger only when the parent process is NOT ccmsetup.exe (SCCM) or IntuneManagementExtension.exe.

• Scenario: Backup Agent Integrity Checks

  • Context: The organization utilizes Veeam Backup & Replication. Its agent service runs a nightly integrity check on the Obsidium software installation directory to ensure backup consistency. This read-heavy operation invokes the Obsidium verification module, mimicking an active security event.
  • Filter/Exclusion: Exclude