Obsidian Sandstorm DLL Sideloading from User-Writable Path with C2 Correlation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

Detects a DLL being loaded into a system process (e.g., Windows/System32, Program Files) from a suspicious or user-writable directory (e.g., AppData, Temp, Downloads), followed by a network connection originating from the same process within a 10-minute window. This behavior is indicative of DLL side-loading used to execute a payload that subsequently initiates C2 communication.