Obsiduim1304ObsiduimSoftware

Hunt Hypothesis

This detection identifies the presence of Obsiduim software on endpoints to establish a baseline for legitimate application behavior and distinguish it from potential masquerading threats. Proactively hunting for this signature in Azure Sentinel allows the SOC team to validate known good processes early, reducing noise and enabling faster identification of anomalies where adversaries mimic trusted software identities.

YARA Rule

rule Obsiduim1304ObsiduimSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 [2] E8 25 00 00 00 EB 04 [4] EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 [2] C3 EB 02 [2] EB 04 [4] 64 67 FF 36 00 00 EB 03 [3] 64 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Obsiduim1304ObsiduimSoftware detection rule, along with suggested filters and exclusions:

• Scenario: Automated Patch Deployment via SCCM/Intune

  • Context: The enterprise uses Microsoft Endpoint Configuration Manager (SCCM) or Intune to push software updates. When the Obsiduim agent is updated or reconfigured by a scheduled deployment task, the YARA rule may flag the installation process as suspicious due to the creation of new registry keys and file modifications in the Program Files\Obsiduim directory.
  • Suggested Filter/Exclusion: Exclude processes originating from the SCCM client (ccmsetup.exe) or Intune Management Extension (IntuneManagementExtension.exe) when they interact with the Obsiduim installation path. Add a condition to ignore alerts where ParentProcessName matches these known deployment agents.

• Scenario: Scheduled Log Rotation and Archive Job

  • Context: A nightly scheduled task (e.g., via Windows Task Scheduler) runs a script to compress and move old Obsiduim logs from the local data directory to a network share. The YARA rule might trigger because the log rotation utility (7z.exe or tar) reads and writes large binary files that match the signature pattern of the Obsiduim software binaries.
  • Suggested Filter/Exclusion: Create an exclusion for file system events where the process name is a known compression tool (e.g., 7z.exe, WinRAR.exe) and the target path contains \Logs\ or \Archive\. Alternatively, whitelist the specific Scheduled Task ID responsible for this rotation.

• Scenario: Endpoint Protection Signature Update

  • Context: The organization’s primary antivirus solution (e.g., CrowdStrike Falcon or Microsoft Defender) performs a real-time scan on