Obsidium V1350 Obsidium Software

Hunt Hypothesis

This hypothesis targets the presence of Obsidium software, a tool frequently utilized by adversaries for data exfiltration or remote access, by identifying its specific version signature within memory or disk artifacts. Proactively hunting for this indicator in Azure Sentinel allows the SOC team to detect low-severity, potentially stealthy footholds before they are leveraged for lateral movement or data theft.

YARA Rule

rule Obsidium_V1350_Obsidium_Software: PEiD
{
    strings:
        $a = { EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 02 ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 20 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 ?? ?? ?? ?? EB 01 ?? EB 02 ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8 }
        $b = { EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 02 ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 20 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 04 ?? ?? ?? ?? 50 EB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Maintenance: An IT administrator manually runs the Obsidium installer or updater executable (e.g., ObsidiumSetup.exe or ObsidiumService.exe) on a specific application server to patch a critical vulnerability in the Obsidium V1350 suite.

  • Filter/Exclusion: Exclude processes where the parent process is explorer.exe or cmd.exe and the file path matches C:\Program Files\Obsidium\ or C:\Apps\Obsidium\, provided the user belongs to the AppAdmins or ServiceAccounts group.

• Scheduled Patch Management Job: A scheduled task (e.g., via Task Scheduler or SCCM) executes the Obsidium maintenance script or binary during the nightly maintenance window to apply cumulative updates across a cluster of web servers.

  • Filter/Exclusion: Exclude executions where the parent process is svchost.exe (specifically the Task Scheduler service) or wuaex.exe, and the command line contains arguments like /update, /patch, or /maintain.

• Backup and Restore Operations: A backup agent (such as Veeam, Commvault, or Windows Server Backup) spawns the Obsidium binary to perform a consistent backup of the Obsidium database or configuration files, or restores them during a disaster recovery drill.

  • Filter/Exclusion: Exclude processes where the parent process name is vssd.exe, wbengine.exe, commvaultagent.exe, or veeamagent.exe, and the working directory is within the backup storage path (e.g., D:\Backups\Obsidium\).

• Application Health Check Script: A PowerShell or batch script executed by an operations team to verify the integrity of the Obsidium installation or check service status, which may load the Obsidium DLLs or execute a small diagnostic binary