Obsidiumv13037ObsidiumSoftware

Hunt Hypothesis

This rule identifies the presence of Obsidium software, a tool frequently used by adversaries to establish persistent access or execute payloads on compromised endpoints. Proactively hunting for this signature allows the SOC to detect low-severity footholds or staging activities that may precede more significant lateral movement or data exfiltration attempts within the Azure environment.

YARA Rule

rule Obsidiumv13037ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 [2] E8 26 00 00 00 EB 03 [3] EB 01 ?? 8B 54 24 0C EB 04 [4] 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 [2] C3 EB 01 ?? EB 04 [4] 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 [3] 50 EB 03 [3] 33 C0 EB 03 [3] 8B 00 EB 04 [4] C3 EB 03 [3] E9 FA 00 00 00 EB 03 [3] E8 D5 FF FF FF EB 04 [4] EB 01 ?? 58 EB 02 [2] EB 03 [3] 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 [3] E8 23 27 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: An administrator performs a manual update or installation of the Obsidium software suite (e.g., via setup.exe or installer.msi) on a jump server or development workstation, where the YARA signature matches the binary or its associated DLLs during the extraction phase.

  • Filter/Exclusion: Exclude processes originating from standard installer paths (e.g., C:\Program Files\Obsidium\, C:\Temp\obsidium_install\) or filter by image name setup.exe/msiexec.exe when the parent process is explorer.exe or cmd.exe with a user-initiated context.

• Scenario: A scheduled maintenance job runs a custom PowerShell script or batch file that invokes the Obsidium CLI tool (obsidium-cli.exe or similar) to perform nightly data backups or log rotations, causing the YARA rule to match the executable file in the file system scan or process memory.

  • Filter/Exclusion: Exclude processes where the parent is svchost.exe (Task Scheduler) or powershell.exe/cmd.exe and the command line contains specific keywords like backup, rotate, or obsidium-cli. Alternatively, whitelist the specific binary hash or path if it is a known, signed version of the tool.

• Scenario: A developer or QA engineer runs the Obsidium application in a debug mode or builds a custom plugin/module using the Obsidium SDK, where intermediate build artifacts or debug binaries (e.g., obsidium_debug.dll, obsidium_test.exe) reside in a non-standard directory like C:\Users\<User>\Desktop\build\ and match the YARA signature.

  • Filter/Exclusion: Exclude processes or files located in user-specific directories (e.g., C:\Users\, C:\Temp\, `C:\Projects\