Obsidium1334ObsidiumSoftware

Hunt Hypothesis

This hunt hypothesis targets the execution of Obsidium software binaries to identify potential legitimate administrative activity or unauthorized tool usage within the environment. A proactive search in Azure Sentinel is recommended to establish a baseline for this specific vendor’s behavior and distinguish it from anomalous processes that may mimic its signature during early-stage reconnaissance.

YARA Rule

rule Obsidium1334ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 [2] E8 29 00 00 00 EB 03 [3] EB 02 [2] 8B 54 24 0C EB 03 [3] 83 82 B8 00 00 00 25 EB 02 [2] 33 C0 EB 02 [2] C3 EB 03 [3] EB 01 ?? 64 67 FF 36 00 00 EB 02 [2] 64 67 89 26 00 00 EB 02 [2] EB 04 [4] 50 EB 02 [2] 33 }
	$a1 = { EB 02 [2] E8 29 00 00 00 EB 03 [3] EB 02 [2] 8B 54 24 0C EB 03 [3] 83 82 B8 00 00 00 25 EB 02 [2] 33 C0 EB 02 [2] C3 EB 03 [3] EB 01 ?? 64 67 FF 36 00 00 EB 02 [2] 64 67 89 26 00 00 EB 02 [2] EB 04 [4] 50 EB 02 [2] 33 C0 EB 01 ?? 8B 00 EB 04 [4] C3 EB 03 [3] E9 FA 00 00 00 EB 02 [2] E8 D5 FF FF FF EB 02 [2] EB 03 [3] 58 EB 02 [2] EB 03 [3] 64 67 8F 06 00 00 EB 03 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Obsidium1334ObsidiumSoftware detection rule, including targeted filters and exclusions:

• Scenario: Scheduled Endpoint Protection Updates

  • Context: The Obsidium software agent performs nightly updates via a scheduled task (ObsidiumUpdateService) that downloads patches from the vendor’s CDN. This process often involves spawning temporary child processes with high network I/O, which mimics the behavior of lateral movement or data exfiltration.
  • Filter/Exclusion: Exclude processes where the parent executable is obsidium_agent.exe (or similar) and the command line contains flags related to “update” or “patch”. Additionally, whitelist the specific vendor update domain (e.g., *.obsidium.com) in network traffic rules.

• Scenario: Admin-Driven Bulk License Deployment

  • Context: During onboarding weeks, System Administrators use PowerShell scripts (Deploy-ObsidiumLicense.ps1) to push license keys and configuration profiles to 50+ workstations simultaneously. This triggers a cascade of process creations that the YARA rule interprets as suspicious mass deployment activity often associated with supply chain attacks.
  • Filter/Exclusion: Create an exclusion based on the user context DOMAIN\Admin or specific service accounts (e.g., svc-deploy). Filter alerts where the parent process is powershell.exe and the command line includes the Obsidium configuration path (e.g., C:\Program Files\Obsidium\Config\).

• Scenario: Automated Backup and Archiving Jobs

  • Context: The enterprise’s backup solution (e.g., Veeam or Commvault) interacts with Obsidium software to archive logs and secure data. These jobs frequently invoke the Obsidium engine to encrypt data blocks, triggering file system events that match the rule’s signature for “unusual software execution