Obsidian Sandstorm: LinkedIn Recruitment Lure DLL Sideloading (ThrottleDrift/RiverGorilla/SilverGorilla)
Detects DLL sideloading and suspicious executable execution patterns associated with Obsidian Sandstorm's recruitment-themed spearphishing campaigns. The rule monitors for unsigned or untrusted DLLs loaded by processes in user-writable directories, and the execution of binaries directly from extracted archive paths containing recruitment-related keywords (e.g., job, resume, payroll).
Microsoft Sentinel (KQL)
