Obsidium V1364 Obsidium Software 20090428

Hunt Hypothesis

This hypothesis targets the presence of the Obsidium software, a legacy application from 2009 that may indicate outdated or unmanaged endpoints within the environment. Proactively hunting for this specific version helps the SOC identify potential attack surfaces or unauthorized legacy installations that could be leveraged by adversaries for persistence or lateral movement.

YARA Rule

rule Obsidium_V1364_Obsidium_Software_20090428: PEiD
{
    strings:
        $a = { EB 02 ?? ?? 50 EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 1E EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 64 FF 30 EB 02 ?? ?? 64 89 20 EB 01 ?? EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 ?? ?? ?? ?? EB 02 ?? ?? E8 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Maintenance: An IT administrator is performing a scheduled maintenance task on a legacy internal tool (e.g., a custom inventory management system or a niche reporting dashboard) that was built using the Obsidium framework in 2009. The executable or its associated DLLs are being copied to a network share or backup location, triggering the YARA signature.

  • Filter/Exclusion: Exclude paths containing \LegacyApps\ or \InternalTools\ and specific file names like ObsidiumCore.dll or ObsidiumApp.exe if they are known to be part of the approved legacy application stack.

• Software Testing and QA Environment: A QA engineer is testing a new version of an application that bundles or depends on the Obsidium 20090428 build for backward compatibility testing. The test environment runs the application from a temporary directory or a dedicated QA folder, causing the YARA rule to match the binary.

  • Filter/Exclusion: Exclude paths under \QA\, \TestEnvironments\, or \Temp\ directories, and consider excluding processes initiated by known QA tools (e.g., Selenium.exe, TestComplete.exe) if the rule is process-based, or exclude specific user accounts designated for testing.

• Backup and Restore Operations: A backup solution (e.g., Veeam, Commvault, or Windows Server Backup) is restoring or scanning a backup image that contains the Obsidium software binaries. The backup agent reads the file into memory or a temporary cache, triggering the detection.

  • Filter/Exclusion: Exclude processes associated with backup agents (e.g., VeeamBackup.exe, CommvaultAgent.exe, wbadmin.exe) and file paths within backup repositories (e.g., \BackupRepo\, \VeeamBackup\).

• Development and Build Pipeline: A