ObsidiumV1342ObsidiumSoftware

Hunt Hypothesis

This detection identifies the execution of Obsidium software components via a specific YARA signature to monitor for legitimate application activity or potential misuse within the environment. Proactive hunting is recommended to establish a baseline of known good behavior and quickly distinguish between routine operations and anomalous usage patterns that could indicate early-stage compromise or unauthorized deployment.

YARA Rule

rule ObsidiumV1342ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 [2] E8 26 00 00 00 EB 03 [3] EB 01 ?? 8B 54 24 0C EB 02 [2] 83 82 B8 00 00 00 24 EB 03 [3] 33 C0 EB 01 ?? C3 EB 02 [2] EB 02 [2] 64 67 FF 36 00 00 EB 03 [3] 64 67 89 26 00 00 EB 03 [3] EB 03 [3] 50 EB 04 [4] 33 C0 EB 03 [3] 8B 00 EB 03 [3] C3 EB 03 [3] E9 FA 00 00 00 EB 03 [3] E8 D5 FF FF FF EB 01 ?? EB 03 [3] 58 EB 04 [4] EB 04 [4] 64 67 8F 06 00 00 EB 04 [4] 83 C4 04 EB 01 ?? E8 C3 27 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the ObsidiumV1342ObsidiumSoftware detection rule, including targeted filters and exclusions:

• Scenario: Automated Deployment of Obsidium Agent Updates via SCCM/Intune

  • Context: The enterprise uses Microsoft Endpoint Configuration Manager (SCCM) or Intune to push the latest Obsidium software updates to all endpoints during a scheduled maintenance window. This triggers the YARA rule as the installer executable (ObsidiumSetup.exe) matches the signature pattern.
  • Filter/Exclusion: Create an exclusion based on the Process Parent. Exclude alerts where the parent process is ccmsetup.exe (SCCM) or IntuneManagementExtension.exe, and the file path contains \Program Files\Microsoft Configuration Manager\AdminConsole\.

• Scenario: Scheduled Backup of Obsidium Configuration Databases

  • Context: A nightly scheduled task runs a backup script that invokes the Obsidium management utility (ObsidiumConfigBackup.exe) to archive configuration files. The YARA rule detects this utility execution as a new software installation event because it writes specific registry keys and config files matching the signature.
  • Filter/Exclusion: Implement an exclusion based on Scheduled Task Name. Filter out alerts where the ProcessCommandLine contains the string \Obsidium\BackupJob or the process name is explicitly ObsidiumConfigBackup.exe running under a specific service account (e.g., DOMAIN\ObsidiumSvc).

• Scenario: IT Admin Manual Installation on New Workstations

  • Context: During the onboarding of new employees, Desktop Support technicians manually run the Obsidium installer from a shared network drive (\\FileServer\Apps\Obsidium\Setup.exe) to install the software suite. This manual execution triggers the rule as it mimics an automated deployment signature.
  • **Filter/Ex