Obsidian Sandstorm Persistence via Run Key Pointing to User-Writable Path

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects unauthorized modifications to Windows Registry Run and RunOnce keys where the configured value points to a file within a user-writable directory (e.g., Temp, AppData, Downloads) or uses rundll32.exe to execute a DLL. This behavior is indicative of persistence mechanisms used by Obsidian Sandstorm, such as sideloading binaries or launching malicious loaders from non-standard, writable locations.