Obsidiumv1304ObsidiumSoftware

Hunt Hypothesis

This hunt targets the presence of Obsidium software artifacts within the environment to identify potential unauthorized or legacy applications that may introduce supply chain risks. Proactively hunting for this signature in Azure Sentinel allows the SOC team to validate legitimate usage and detect anomalous deployments before they evolve into higher-severity incidents.

YARA Rule

rule Obsidiumv1304ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 [2] E8 25 00 00 00 EB 04 [4] EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 [2] C3 EB 02 [2] EB 04 [4] 64 67 FF 36 00 00 EB 03 [3] 64 67 89 26 00 00 EB 02 [2] EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 }
	$a1 = { EB 02 [2] E8 25 00 00 00 EB 04 [4] EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 [2] C3 EB 02 [2] EB 04 [4] 64 67 FF 36 00 00 EB 03 [3] 64 67 89 26 00 00 EB 02 [2] EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 [2] E9 FA 00 00 00 EB 02 [2] E8 D5 FF FF FF EB 03 [3] EB 04 [4] 58 EB 02 [2] EB 04 [4] 64 67 8F 06 00 00 EB 03 [3] 83 C4 04 EB 01 ?? E8 3B 26 00 00 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Obsidiumv1304ObsidiumSoftware detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Endpoint Protection Updates

  • Context: The Obsidium Software agent runs a daily scheduled task at 02:00 AM to download and install security definition updates. This process often spawns the main executable (ObsidiumAgent.exe) with high I/O activity that mimics suspicious behavior patterns defined in the YARA rule.
  • Filter/Exclusion: Create an exclusion for the specific scheduled task path C:\Program Files\Obsidium\Updates\ScheduledUpdateTask and exclude the process ObsidiumAgent.exe when launched by the Windows Task Scheduler service (svchost.exe with the “Tasks” session).

• Scenario: Deployment via Microsoft Endpoint Configuration Manager (SCCM)

  • Context: During enterprise-wide software deployments, SCCM pushes the Obsidium installation package to new workstations. The deployment agent executes the installer which triggers the YARA signature due to the unpacking of compressed archives and registry modifications characteristic of the rule’s logic.
  • Filter/Exclusion: Exclude alerts where the parent process is ccmsetup.exe or wuauserv.exe, specifically filtering out events occurring within 15 minutes of a detected “Software Installation” event in the SCCM console logs.

• Scenario: Automated Backup and Archiving Jobs

  • Context: Enterprise backup solutions like Veeam or Rubrik often integrate with Obsidium to scan files before archiving. When these tools invoke Obsidium’s scanning engine, the resulting process tree matches the rule’s signature for “Obsidium Software” activity, leading to false positives during nightly backup windows.
  • Filter/Exclusion: Implement a filter that suppresses alerts if the command line arguments