ObsidiumV1258V133XObsidiumSoftware

Hunt Hypothesis

This detection identifies the presence of Obsidium software components within the environment to establish a baseline for legitimate application behavior and distinguish it from potential masquerading threats. Proactively hunting for this signature in Azure Sentinel allows the SOC team to validate known good processes early, reducing noise and enhancing the accuracy of future anomaly-based detections involving similar software families.

YARA Rule

rule ObsidiumV1258V133XObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 ?? E8 ?? 00 00 00 EB 02 [2] EB }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the ObsidiumV1258V133XObsidiumSoftware detection rule, tailored for an enterprise environment:

• Scenario: Scheduled Backup Execution by Veeam or Commvault

  • Context: Enterprise backup agents (e.g., Veeam Agent for Windows, Commvault Client) often utilize Obsidium software components as part of their underlying storage engine or virtualization layer. During nightly scheduled maintenance windows, these agents spawn processes that match the YARA signature, triggering alerts during high-volume data transfer periods.
  • Suggested Filter/Exclusion: Create a whitelist exclusion based on the specific process name (e.g., VeeamService.exe or CommServeAgent.exe) and restrict the rule to only trigger if the parent process is not a known backup service. Alternatively, exclude alerts occurring during defined maintenance windows (e.g., 02:00–04:00 local time).

• Scenario: Deployment of Obsidium Modules via Microsoft Endpoint Configuration Manager (SCCM)

  • Context: When the IT Operations team pushes a new patch or module update for Obsidium software across the domain using SCCM, the installation service (ccmsetup.exe) extracts and executes the Obsidium binaries. This mass deployment activity generates thousands of simultaneous detections that are purely administrative in nature.
  • Suggested Filter/Exclusion: Implement an exclusion based on the parent process ccmexec.exe or wuauserv.exe. Additionally, filter out alerts where the file hash matches a known “Golden Image” hash stored in the asset management database for the current Obsidium version.

• Scenario: Automated Scanning by CrowdStrike Falcon or SentinelOne

  • Context: Endpoint Detection and Response (EDR) agents like CrowdStrike or SentinelOne often perform deep file system scans