Obsidium13037ObsidiumSoftware

Hunt Hypothesis

This rule targets the presence of Obsidium software, a known tool often utilized by adversaries for data exfiltration or remote access, indicating a potential foothold in the environment. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify low-severity indicators of compromise early, preventing the software from being leveraged for lateral movement or persistent access before it escalates in impact.

YARA Rule

rule Obsidium13037ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 [2] E8 26 00 00 00 EB 03 [3] EB 01 ?? 8B 54 24 0C EB 04 [4] 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 [2] C3 EB 01 ?? EB 04 [4] 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 [3] 50 EB 03 [3] 33 C0 EB 03 [3] 8B 00 EB 04 [4] C3 EB 03 [3] E9 FA 00 00 00 EB 03 [3] E8 D5 FF FF FF EB 04 [4] EB 01 ?? 58 EB 02 [2] EB 03 [3] 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 [3] E8 23 27 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Obsidium Software License Validation or Update Service: The Obsidium software suite (often used for enterprise document management or specific industry verticals) may run a background service or scheduled task that validates license keys or checks for updates. This process can involve writing temporary files to %TEMP% or %APPDATA% that match the YARA signature for the software’s binary or configuration blobs.
  • Filter/Exclusion: Exclude processes where the parent process is ObsidiumService.exe or ObsidiumUpdater.exe, or exclude file paths under C:\Program Files\Obsidium\ and C:\Users\%USERNAME%\AppData\Local\Obsidium\.
• IT Admin Deploying Obsidium via Group Policy or SCCM: When IT administrators deploy the Obsidium software package to endpoints via System Center Configuration Manager (SCCM) or Group Policy Software Installation, the installation agent (CCMEXEC.EXE or GPMMSVC.EXE) may extract or stage the Obsidium binaries in temporary directories (C:\Windows\Installer\ or C:\Windows\Temp\) before moving them to the final location. These staged files often retain the original YARA signature.
  • Filter/Exclusion: Exclude events where the parent process is CCMEXEC.EXE, GPMMSVC.EXE, or MsiExec.exe, and the file path contains \Windows\Installer\ or \Windows\Temp\.
• Antivirus/EDR Quarantine or Scan Cache: Security tools like Microsoft Defender for Endpoint, CrowdStrike Falcon, or SentinelOne maintain local caches of scanned or quarantined files. If a previous version of Obsidium was scanned or quarantined, the cached copy in the security tool’s local database (e.g., C:\ProgramData\Microsoft\Windows Defender\Scans\ or `C:\Program