ObsidiumV12XObsidiumSoftware

Hunt Hypothesis

This detection identifies the presence of Obsidium software components within the environment to establish a baseline for legitimate application behavior and potential supply chain indicators. Proactively hunting for this signature in Azure Sentinel allows the SOC team to distinguish between expected software deployment and anomalous instances that could signal unauthorized installation or early-stage lateral movement by an adversary leveraging known tools.

YARA Rule

rule ObsidiumV12XObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 0E 00 00 00 33 C0 8B 54 24 0C 83 82 B8 00 00 00 0D C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the ObsidiumV12XObsidiumSoftware detection rule, including suggested filters and exclusions:

• Scenario: Automated Patch Deployment via SCCM/Intune

  • Context: The enterprise uses Microsoft Endpoint Configuration Manager (SCCM) or Intune to push a mandatory update package for the Obsidium software suite during off-hours. The deployment agent executes the installer binary (ObsidiumSetup.exe) which matches the YARA signature, triggering an alert on multiple endpoints simultaneously.
  • Filter/Exclusion: Create a process exclusion based on the parent process name ccmsetup.exe (for SCCM) or Microsoft.IntuneManagementAgent.exe (for Intune). Alternatively, exclude alerts where the file path contains \Program Files\Obsidium\Updates\.

• Scenario: Scheduled Daily Antivirus Scan

  • Context: The internal antivirus solution (e.g., CrowdStrike Falcon or SentinelOne) runs a scheduled daily scan at 02:00 AM. During this scan, the engine extracts and analyzes the Obsidium software binaries located in the installation directory, causing the YARA rule to match against the scanned files rather than an active execution threat.
  • Filter/Exclusion: Exclude alerts where the parent process is falcon.sys (CrowdStrike) or sentinelone.exe and the event type is “File Scan” or “On-Access Scan.” Additionally, filter by time window to exclude events occurring between 01:30 and 04:00 daily.

• Scenario: Admin Manual Installation on New Workstations

  • Context: The Desktop Support team performs a bulk rollout of Obsidium software to new hires or replaced hardware using a standardized PowerShell script (Install-Obsidium.ps1). This script invokes the installer directly, generating legitimate execution