ObsidiumV12ObsidiumSoftware

Hunt Hypothesis

This detection identifies the presence of Obsidium software components via a specific YARA signature to monitor for legitimate application usage or potential unauthorized deployment within the environment. A proactive hunt is recommended in Azure Sentinel to establish a baseline of known good processes and quickly distinguish between expected software behavior and anomalous activity that could indicate supply chain compromise or shadow IT adoption.

YARA Rule

rule ObsidiumV12ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 [2] E8 77 1E 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the ObsidiumV12ObsidiumSoftware detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Backup Agent Execution

  • Context: The enterprise uses Veeam Backup & Replication or Rubrik, which installs a background service (ObsidiumService.exe) that runs nightly at 2:00 AM to perform integrity checks on the backup repository. This activity triggers the YARA rule because it matches the software signature of the Obsidium agent running in production mode.
  • Suggested Filter/Exclusion: Create an exclusion based on the Process Name (ObsidiumService.exe) combined with a Time Window (e.g., 02:00 to 04:00). Additionally, exclude the specific Parent Process if it is known to be the backup engine (e.g., VeeamBkpSvc.exe or rubrik-agent.exe).

• Scenario: Patch Management Deployment

  • Context: During a weekly maintenance window, the IT team utilizes Microsoft Endpoint Configuration Manager (SCCM) or Ivanti Neurons to push a security update to the Obsidium software suite. The deployment agent launches the Obsidium installer (ObsidiumSetup.exe) on endpoints to apply patches, causing a high volume of file creation and process spawning that matches the detection logic.
  • Suggested Filter/Exclusion: Exclude events where the Parent Process is identified as ccmexec.exe (SCCM) or IvantiAgent.exe. Alternatively, filter by User Context, excluding alerts generated under the local system account (NT AUTHORITY\SYSTEM) during known maintenance windows defined in the ticketing system.

• Scenario: Endpoint DLP Policy Scanning

  • Context: The organization employs