ObsidiumV1258ObsidiumSoftware

Hunt Hypothesis

This detection identifies the execution of Obsidium software components via a specific YARA signature to distinguish legitimate application activity from potential masquerading threats. Proactive hunting for this behavior in Azure Sentinel is essential to establish a baseline of trusted software operations and quickly identify anomalies where unknown processes mimic known Obsidium binaries.

YARA Rule

rule ObsidiumV1258ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 ?? E8 ?? 00 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the ObsidiumV1258ObsidiumSoftware detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Antivirus Definition Updates

  • Context: The Obsidium software (often used in endpoint protection suites) runs a daily scheduled task at 03:00 AM to download and install the latest virus definition database. This process involves extracting large compressed archives and writing them to disk, which mimics the signature pattern of the YARA rule.
  • Filter/Exclusion: Create an exclusion for the specific executable path C:\Program Files\Obsidium\Engine\upd_service.exe running under the system account (NT AUTHORITY\SYSTEM). Additionally, exclude file paths matching C:\ProgramData\Obsidium\Updates\*.cab.

• Scenario: Enterprise Backup Agent Scans

  • Context: During nightly backup windows (e.g., 20:00–04:00), the Veeam or Commvault backup agent scans the Obsidium installation directory to capture state changes. The backup engine’s file I/O operations on the ObsidiumSoftware binaries trigger the YARA rule as it reads the executable headers.
  • Filter/Exclusion: Exclude processes where the parent process is a known backup service, such as VeeamTransportService.exe, vss.exe, or commvault_service.exe. The exclusion logic should be: Process Name contains "Obsidium" AND Parent Process IN (List of Backup Services).

• Scenario: Software Deployment via SCCM/Intune

  • Context: When the IT team pushes a patch or version upgrade to the Obsidium suite using Microsoft Endpoint Configuration Manager (SCCM) or Intune, the deployment client (ccmsetup.exe or Microsoft.IntuneManagementAgent)