Obsidium1332ObsidiumSoftware

Hunt Hypothesis

This rule identifies the presence of the Obsidium1332ObsidiumSoftware artifact, which is often associated with specific software installations or potential backdoor components that adversaries may deploy to establish persistence or execute malicious payloads. Proactively hunting for this signature allows the SOC team to detect low-severity footholds or known tooling in the environment before they are leveraged for lateral movement or data exfiltration.

YARA Rule

rule Obsidium1332ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 ?? E8 2B 00 00 00 EB 02 [2] EB 02 [2] 8B 54 24 0C EB 03 [3] 83 82 B8 00 00 00 24 EB 04 [4] 33 C0 EB 04 [4] C3 EB 02 [2] EB 01 ?? 64 67 FF 36 00 00 EB 03 [3] 64 67 89 26 00 00 EB 01 ?? EB 02 [2] 50 EB 02 [2] 33 C0 EB 02 [2] 8B 00 EB 02 [2] C3 EB 04 [4] E9 FA 00 00 00 EB 03 [3] E8 D5 FF FF FF EB 03 [3] EB 01 ?? 58 EB 01 ?? EB 02 [2] 64 67 8F 06 00 00 EB 02 [2] 83 C4 04 EB 02 [2] E8 3B 27 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or IT admin installs the Obsidium desktop application (a popular note-taking and knowledge management tool) via its standard installer or portable executable on a workstation. The YARA rule likely matches the binary name, version string, or specific code patterns associated with the ObsidiumSoftware package, flagging the legitimate application binary.

  • Filter/Exclusion: Exclude files located in standard application directories such as C:\Program Files\Obsidium\ or C:\Users\<User>\AppData\Local\Obsidium\. Additionally, whitelist the specific SHA-256 hash of the official Obsidium installer or main executable if the organization uses a standardized build.

• Scenario: An automated software deployment script (e.g., using SCCM, Intune, or Ansible) pushes the Obsidium application to a fleet of user workstations. The deployment agent or the temporary extraction folder during installation may contain the Obsidium binary or installer, triggering the YARA rule on the temporary files or the service process executing the install.

  • Filter/Exclusion: Exclude processes or files spawned by known deployment agents (e.g., ccmexec.exe for SCCM, IntuneAgent.exe for Intune). Filter out files in temporary directories like C:\Windows\Temp\ or C:\Users\<User>\AppData\Local\Temp\ if they are associated with deployment service accounts.

• Scenario: A backup or snapshot tool (e.g., Veeam, Commvault, or Windows Volume Shadow Copy) creates a shadow copy or backup archive that includes the Obsidium application files. If the YARA rule is applied to file scanning on backup repositories or during the backup process, it may detect the Obsidium binary within the backup container or the backup service’s memory/file handles.

  • Filter/Exclusion: Exclude files with backup-related