ObsidiumV1304ObsidiumSoftware

Hunt Hypothesis

This detection identifies the presence of Obsidium software components within the environment to establish a baseline for legitimate application behavior and potential supply chain risks. Proactively hunting for this signature in Azure Sentinel allows the SOC team to validate known good processes against anomalous execution patterns, ensuring that any deviations or unauthorized instances are promptly investigated before they evolve into broader security incidents.

YARA Rule

rule ObsidiumV1304ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 [2] E8 ?? 00 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the ObsidiumV1304ObsidiumSoftware detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Antivirus Definition Updates via Obsidium Agent

  • Context: The Obsidium endpoint agent automatically downloads and installs daily definition updates during off-hours (e.g., 2:00 AM). This process triggers the YARA signature as a new software installation event, even though no user interaction occurred.
  • Filter/Exclusion: Create an exclusion based on the Process Name (ObsidiumUpdateService.exe) and restrict it to a specific Time Window (e.g., 01:00–04:00 local time). Additionally, exclude events where the User Context is SYSTEM or a dedicated service account like svc-obsidium-upd.

• Scenario: Deployment of Obsidium Policy Templates by IT Admins

  • Context: During quarterly security reviews, IT administrators use PowerShell scripts to push new policy configurations to endpoints. The script invokes the Obsidium management console (ObsidiumConsole.exe), which generates a file modification event matching the rule’s signature for “software installation.”
  • Filter/Exclusion: Exclude events where the Parent Process is powershell.exe or taskeng.exe (Task Scheduler) and the Initiating User belongs to the IT-Admins Active Directory group. This ensures that administrative bulk actions do not trigger alerts for individual user software installs.

• Scenario: Automated Patching via SCCM/Intune Integration

  • Context: The enterprise uses Microsoft Endpoint Configuration Manager (SCCM) or Intune to deploy Obsidium software updates across the fleet. When a deployment package executes, it launches the Obsidium installer in the background, triggering the detection logic as if a