ObsidiumV130XObsidiumSoftware

Hunt Hypothesis

This detection identifies the presence of Obsidium software components within the environment to establish a baseline for legitimate application behavior and detect potential unauthorized deployments or supply chain anomalies. Proactive hunting is essential in Azure Sentinel to validate these signatures against known good configurations, ensuring that low-severity signals do not mask subtle indicators of compromise or misconfigurations in the broader security posture.

YARA Rule

rule ObsidiumV130XObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 03 [3] E8 2E 00 00 00 EB 04 [4] EB 04 [4] 8B [3] EB 04 [4] 83 [6] EB 01 ?? 33 C0 EB 04 [4] C3 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the ObsidiumV130XObsidiumSoftware detection rule, including suggested filters and exclusions:

• Scenario: Automated patching by Microsoft System Center Configuration Manager (SCCM) or Microsoft Intune.

  • Context: During scheduled maintenance windows, these tools push updates to the Obsidium software suite across thousands of endpoints. The YARA rule triggers on the deployment executable (ObsidiumUpdater.exe) which matches the signature logic intended for suspicious manual execution.
  • Suggested Filter/Exclusion: Create a process exclusion based on the parent process name ccmsetup.exe (SCCM) or IntuneManagementExtension.exe. Alternatively, filter alerts where the file path contains \Program Files\Microsoft Configuration Manager\.

• Scenario: Execution of Obsidium components by Windows Scheduled Tasks for nightly data synchronization.

  • Context: The enterprise runs a nightly job named “Obsidium Data Sync” that launches ObsidiumSyncService.exe to aggregate logs. Since this occurs automatically via the Task Scheduler service (TaskScheduler.exe) rather than user interaction, it mimics the behavior of a potential lateral movement or scheduled malware execution.
  • Suggested Filter/Exclusion: Exclude events where the parent process is svchost.exe (specifically the “TaskScheduler” service) and the command line contains arguments specific to the sync job (e.g., /mode=sync).

• Scenario: Deployment of Obsidium agents via Ansible or Terraform automation pipelines.

  • Context: DevOps teams use Ansible playbooks to provision new workstations, installing the Obsidium software stack during the initial build phase. The installation process involves multiple child processes spawning from ansible-playbook runners, triggering the rule on every component installation.

  ---