Obsidiumv1111

Hunt Hypothesis

This detection identifies potential low-severity file-based threats matching the Obsidiumv1111 signature, which may indicate early-stage malware or benign software activity requiring validation. A proactive hunt is essential to distinguish between false positives and genuine indicators of compromise, ensuring that subtle adversary behaviors are not overlooked before they escalate within the Azure Sentinel environment.

YARA Rule

rule Obsidiumv1111
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 [2] E8 E7 1C 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the Obsidiumv1111 detection rule in a legitimate enterprise environment, along with suggested filters and exclusions:

• Scenario: Scheduled Antivirus Definition Updates via Windows Update Service

  • Context: The WindowsUpdate service or third-party agents (e.g., Microsoft Defender, CrowdStrike) frequently download and install new signature definitions during off-hours. These updates often involve the creation of temporary executable files in standard directories that match the YARA signatures for Obsidiumv1111.
  • Suggested Filter/Exclusion: Exclude file paths matching C:\ProgramData\Microsoft\Windows Defender\Platform and C:\Program Files\Common Files\Microsoft Shared. Additionally, filter events where the parent process is usoc_dcl.exe or MsMpEng.exe with a scheduled task trigger.

• Scenario: Enterprise Endpoint Management Agent Deployment (Intune/SCCM)

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune agents push application updates and configuration scripts to endpoints. During these deployments, the agent creates temporary staging files in %TEMP% or specific deployment folders that mimic the behavioral patterns of the Obsidiumv1111 rule.
  • Suggested Filter/Exclusion: Create an exclusion for processes named ccmsetup.exe, IntuneManagementExtension.exe, and TaskHostW.exe. Apply a filter to ignore alerts where the file path contains \Microsoft Intune Management Extension\ or \CCMCache\.

• Scenario: Automated Backup and Archiving Jobs (Veeam/Acronis)

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Acronis Cyber Protect run nightly jobs that compress data into temporary archives. The compression engines often spawn helper processes that generate file