Obsidium1338ObsidiumSoftware

Hunt Hypothesis

This detection identifies the presence of Obsidium software components within the environment to establish a baseline for legitimate application behavior and potential supply chain risks. Proactive hunting is essential in Azure Sentinel to distinguish these known binaries from anomalous execution patterns that could indicate unauthorized deployment or early-stage compromise by an adversary leveraging trusted software.

YARA Rule

rule Obsidium1338ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 04 [4] E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 [4] 83 82 B8 00 00 00 ?? EB 04 [4] 33 C0 EB 03 [3] C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 [3] 64 67 89 26 00 00 EB 02 [2] EB 01 ?? 50 EB 04 [4] 33 C0 EB 02 [2] 8B 00 EB 03 [3] C3 EB 03 [3] E9 FA 00 00 00 EB 03 [3] E8 D5 FF FF FF EB 02 [2] EB 04 [4] 58 EB 04 [4] EB 02 [2] 64 67 8F 06 00 00 EB 04 [4] 83 C4 04 EB 04 [4] E8 57 27 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Obsidium1338ObsidiumSoftware detection rule, along with suggested filters and exclusions:

• Scenario: Legitimate deployment of Obsidium software updates via Microsoft Endpoint Configuration Manager (SCCM/MECM).

  • Context: During scheduled maintenance windows, SCCM pushes the latest Obsidium agent or module update to all endpoints. The YARA rule triggers because the installer executable (ObsidiumSetup.exe) matches the signature pattern intended for suspicious ad-hoc execution.
  • Suggested Filter/Exclusion: Create an exclusion based on the Process Parent Name being ccmsetup.exe (SCCM Client) or WUAHandler.exe (Windows Update Agent), and restrict the trigger to the specific file path: C:\Program Files\Obsidium\Setup\.

• Scenario: Execution of Obsidium’s internal scheduled maintenance job by the Windows Task Scheduler.

  • Context: A daily automated task named “Obsidium Data Sync” runs at 02:00 AM to archive logs or sync configuration data. The rule flags this as a new, unknown process execution because it occurs outside standard business hours and is not initiated by an interactive user session.
  • Suggested Filter/Exclusion: Exclude events where the Process Command Line contains the specific task identifier Obsidium.SyncJob AND the User Account is the local system account (NT AUTHORITY\SYSTEM).

• Scenario: Administrative manual installation or configuration by a privileged Help Desk technician.

  • Context: A member of the “IT_Ops” group manually installs Obsidium on a new workstation using an elevated PowerShell session or the GUI installer. The rule triggers because the execution context involves high-privilege accounts (DOMAIN\HelpDesk_Admin) running non-standard scripts that invoke the Obsidium binary.