This rule detects the presence of Obsidium software, a tool frequently used by adversaries for data exfiltration and remote access, indicating potential unauthorized access or data staging activities. Proactively hunting for this signature allows the SOC team to identify compromised endpoints or suspicious processes before they are leveraged for lateral movement or data theft within the Azure Sentinel environment.
rule ObsidiumV1350ObsidiumSoftware
{
meta:
author="malware-lu"
strings:
$a0 = { EB 03 [3] E8 [4] EB 02 [2] EB 04 [4] 8B 54 24 0C EB 04 [4] 83 82 B8 00 00 00 20 EB 03 [3] 33 C0 EB 01 ?? C3 EB 02 [2] EB 03 [3] 64 67 FF 36 00 00 EB 03 [3] 64 67 89 26 00 00 EB 01 ?? EB 04 [4] 50 EB 04 [4] 33 C0 EB 04 [4] 8B 00 EB 03 [3] C3 EB 02 [2] E9 FA 00 00 00 EB 01 ?? E8 [4] EB 01 ?? EB 02 [2] 58 EB 04 [4] EB 02 [2] 64 67 8F 06 00 00 EB 02 [2] 83 C4 04 EB 01 ?? E8 }
condition:
$a0 at pe.entry_point
}This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
obsidian.exe binary or its associated plugin DLLs.
%LOCALAPPDATA%\Obsidian\ or %PROGRAMFILES%\Obsidian\ where the executable name is obsidian.exe and the version string matches 1.3.5.0.ObsidiumV1350 (or similar) for a specific project, which is copied to a shared network drive or a temporary staging folder (C:\Temp\ or \\fileserver\staging\) for distribution, triggering the rule due to the filename or embedded string.
C:\Temp\, C:\Users\Public\Temp\, \\fileserver\staging\) if the file extension is .exe, .dll, or .ps1 and the parent process is a known admin tool like PowerShell.exe or cmd.exe performing a copy operation.C:\jenkins\workspace\build-123\).