ObsidiumV125ObsidiumSoftware

Hunt Hypothesis

This detection identifies the presence of Obsidium Software processes or files within the environment to establish a baseline for legitimate application activity. Proactively hunting for this signature in Azure Sentinel allows the SOC team to distinguish known good software from potential masquerading threats that may mimic similar process names or behaviors.

YARA Rule

rule ObsidiumV125ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the ObsidiumV125ObsidiumSoftware detection rule, including suggested filters and exclusions:

• Scheduled Inventory Scans by Obsidium Endpoint Security Agent

  • Scenario: The Obsidium endpoint agent runs a scheduled daily inventory scan (typically at 02:00 AM) to update asset metadata. This process launches the ObsidiumService.exe binary which matches the YARA signature, triggering an alert during off-hours when no user activity is present.
  • Filter/Exclusion: Create a time-based exclusion for alerts generated between 01:30 and 02:45 on weekdays where the parent process is ObsidiumScheduler.exe or the file path contains \Program Files\Obsidium\Agent\.

• Patch Deployment via Microsoft SCCM/Intune

  • Scenario: During a monthly patching window, System Center Configuration Manager (SCCM) or Microsoft Intune deploys an update package to the Obsidium software suite. The installation service (msiexec.exe) extracts and executes the updated ObsidiumCore.dll, which triggers the rule as a new file creation event rather than malicious behavior.
  • Filter/Exclusion: Exclude alerts where the parent process is ccmsetup.exe (SCCM) or IntuneAgent.exe and the execution path matches C:\Program Files\Obsidium\Updates\.

• Admin Manual Configuration via Obsidium Console

  • Scenario: A system administrator manually logs into a workstation to modify security policies using the Obsidium Management Console. The console launches a background worker process (ObsidiumWorker.exe) to apply changes, which matches the YARA rule signature for “Obsidium Software” activity.
  • Filter/Exclusion: Implement a user-based exclusion where alerts are suppressed if