Obsidiumv1250ObsidiumSoftware

Hunt Hypothesis

This hypothesis targets the presence of the Obsidium software, a known tool often utilized by adversaries for data exfiltration or remote access, by identifying its unique code signature within Azure Sentinel. Proactively hunting for this indicator allows the SOC team to detect low-severity but potentially persistent footholds or staging activities that may not trigger immediate high-fidelity alerts, thereby reducing the risk of undetected lateral movement or data leakage.

YARA Rule

rule Obsidiumv1250ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Maintenance: An IT administrator is manually updating the configuration files or applying a hotfix to the Obsidiumv1250 software on a specific application server. The YARA rule may match the binary or associated DLLs during the file copy or verification process.

  • Filter/Exclusion: Exclude processes running from the specific installation directory (e.g., C:\Program Files\Obsidium\Obsidiumv1250\) or exclude the parent process cmd.exe/powershell.exe when the target file path matches the known Obsidium installation path.

• Scheduled Backup Job: A nightly backup agent (e.g., Veeam, Commvault, or Windows Server Backup) is reading the Obsidiumv1250 executable or its data files to create a snapshot. The YARA scan might trigger on the in-memory copy or the temporary file created during the backup staging process.

  • Filter/Exclusion: Exclude the backup service executable (e.g., vssadmin.exe, wbadmin.exe, or the specific vendor’s backup agent process) as the parent process, or exclude file paths under the backup staging directory (e.g., C:\BackupStaging\).

• Antivirus/EDR Real-Time Scanning: The endpoint protection software (e.g., CrowdStrike, Microsoft Defender, or SentinelOne) is performing a real-time scan of the Obsidiumv1250 binary upon access. The YARA rule might be evaluated against the file in the cache or during the scan operation, causing a self-trigger or a false positive on the scanning process.

  • Filter/Exclusion: Exclude the EDR/AV service process (e.g., MsMpEng.exe, CrowdStrike Falcon Sensor, SentinelOne Agent) as the parent process, or exclude file paths within