Obsidian Sandstorm DLL Sideloading from User-Writable Paths (ThrottleDrift/RiverGorilla/SilverGorilla)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects potential DLL sideloading by identifying instances where a process executing from a user-writable path (e.g., \Users, \ProgramData, \Temp) loads a DLL that resides in the same directory. This pattern is commonly associated with malicious payloads delivered via phishing archives where a legitimate binary and a malicious DLL are placed in the same folder to facilitate sideloading.