This rule identifies the presence of the Obsidium 1337 software, a known tool often utilized for initial access or lateral movement, indicating potential compromise by threat actors leveraging this specific utility. Proactively hunting for this signature allows the SOC to detect low-severity indicators of compromise that may have been missed by standard behavioral alerts, ensuring early identification of adversaries using this known tooling within the Azure environment.
rule Obsidium_1337_Obsidium_Software_additional: PEiD
{
strings:
$a = { EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00 }
condition:
$a at pe.entry_point
}This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Legacy .NET Application Deployment: An enterprise IT team deploys a custom internal line-of-business application (e.g., InventoryManager.exe) built with an older version of the .NET Framework or C# that includes specific string literals or metadata patterns matching the YARA rule’s heuristic for Obsidium 1337. This is common in environments where older applications are not yet refactored to modern frameworks.
C:\Program Files\InternalApps\InventoryManager\) or filter by the specific executable name (InventoryManager.exe) if the rule is known to match this binary.Third-Party Backup Agent: A backup solution agent (e.g., Veeam, Commvault, or Acronis) stores temporary cache files or configuration snapshots in a local directory that contain embedded strings or binary patterns resembling the Obsidium 1337 signature. These files are often transient and reside in standard backup temp folders.
.tmp, .bak, or .cache located in known backup agent directories (e.g., C:\ProgramData\Veeam\Backup\ or C:\Windows\Temp\) and filter by process name (e.g., veeam.exe, cvpp.exe).Development Environment Artifacts: Developers working on C# or .NET projects use IDEs (e.g., Visual Studio, Rider) that generate intermediate build artifacts (e.g., obj/Debug/, bin/Release/) containing compiled DLLs or PDB files. These artifacts may contain debug symbols or string constants that trigger the YARA rule, especially if the project includes specific logging or utility libraries.