Suspicious Shell Execution via Obsidian

Luís Marques@remotecodeexecution

•updated today•0•0•0

Detects the execution of shell interpreters (such as cmd, powershell, bash, osascript) as child processes of the Obsidian note-taking application. This behavior was observed in the REF6598 campaign where threat actors abused the "Shell Commands" community plugin to deliver the PHANTOMPULSE RAT. It also detects specific command-line indicators associated with the campaign.