Obsidian Sandstorm DLL Sideloading via Signed Process Loading Unsigned DLL from Non-Standard Path
Detects DLL sideloading activity linked to Obsidian Sandstorm campaigns. It identifies legitimate, signed processes loading unsigned DLLs from non-standard, user-writable directories (such as Temp, Downloads, or Desktop) or the same directory as the executing process, specifically monitoring for indicators associated with malware families like ThrottleDrift and SilverGorilla.
Microsoft Sentinel (KQL)
