Obsidium

Hunt Hypothesis

The rule “Obsidium” likely detects specific network traffic patterns or host behaviors associated with the Obsidium threat actor or tooling, potentially indicating lateral movement or command-and-control activity. Proactively hunting for this signature allows the SOC to identify low-severity anomalies that may represent early-stage reconnaissance or persistent access, enabling intervention before the adversary escalates their operations within the Azure environment.

YARA Rule

rule obsidium : Packer
{
	meta:
		author="Kevin Falcoz"
		date_create="21/01/2013"
		last_edit="17/03/2013"
		description="Obsidium"

	strings:
		$str1={EB 02 [2] E8 25 00 00 00 EB 04 [4] EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 [2] C3 EB 02 [2] EB 04} /*EntryPoint*/

	condition:
		$str1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Windows Update Service (wuauserv) Execution: The Windows Update client service (wuauserv.exe) frequently spawns child processes or interacts with system binaries that may match the “Obsidium” signature if the rule is based on specific hash values or path patterns associated with update components. This is a standard background task in all Windows Server and Client environments.
  • Filter/Exclusion: Exclude processes where the parent process is svchost.exe (specifically the group hosting wuauserv) or where the image path is under C:\Windows\System32\.
• Microsoft Defender Antivirus Real-Time Protection: The Microsoft Defender service (MsMpEng.exe) or its associated worker processes (MsMpEng.exe child processes) often execute temporary files or scan operations that can mimic the file attributes or execution context targeted by the Obsidium rule. This is a core security function present on all endpoints.
  • Filter/Exclusion: Exclude processes where the image path contains C:\ProgramData\Microsoft\Windows Defender\ or where the parent process is MsMpEng.exe.
• Scheduled Task: “Microsoft\Windows\InstallService\ScanForUpdates” or similar: Many enterprise environments run scheduled tasks for patch management or software inventory (e.g., SCCM, Intune, or third-party tools like Ansible) that execute PowerShell or batch scripts in the C:\Windows\Temp or C:\ProgramData directories. If the Obsidium rule triggers on specific file creation or execution in these common temp/data paths, legitimate maintenance jobs will fire the alert.
  • Filter/Exclusion: Exclude events where the process path matches known maintenance tool directories (e.g., C:\Program Files\Microsoft Configuration Manager\, C:\Program Files\Intune\) or where the scheduled task name contains Microsoft\Windows\.