PhantomVault — PHANTOMPULSE Blockchain-C2 RAT via Obsidian

Looks for: Obsidian.exe loading a DLL from a user-writable path (the side-load). Accomplishes: catches the trusted-process cover. FP: low — Obsidian's own DLLs load from its install dir; tune to your module-load schema.

// HUNT: PHANTOMPULSE DLL side-load into Obsidian
// MITRE: T1574.002, T1036 | CONF: high  FP: low  COST: low
// FP NOTES: genuine Obsidian DLLs load from its install dir; flag user-path/unsigned
#event_simpleName=/ImageLoad|ClassifiedModuleLoad|ModuleLoadFromMemory/
| FileName=/^Obsidian\.exe$/i
| ImageFileName=/\\(Temp|AppData|Downloads|Users\\Public|ProgramData)\\.+\.dll$/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, SHA256HashData], limit=200)

Looks for: Obsidian.exe running from a non-standard path (portable/relocated copy used for side-load staging). FP: some legit portable use — correlate to Q1.

// HUNT: Obsidian running from a non-standard (staging) path
// MITRE: T1574.002 | CONF: medium  FP: medium  COST: low
// TUNING: baseline legit Obsidian install paths; flag user/temp/download dirs; correlate to Q1
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^Obsidian\.exe$/i
| ImageFileName=/\\(Temp|Downloads|Users\\Public|ProgramData)\\/i
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine], limit=200)

Looks for: Obsidian.exe (a note app) spawning shells/LOLBins/recon — abnormal for a markdown editor. Accomplishes: the RAT running inside the trusted process. FP: low — Obsidian rarely spawns cmd/powershell.

// HUNT: PHANTOMPULSE child execution from Obsidian
// MITRE: T1059, T1036 | CONF: med-high  FP: low-med  COST: low
// FP NOTES: a note app should not spawn cmd/powershell/recon tooling
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^Obsidian\.exe$/i
| FileName=/^(cmd|powershell|pwsh|wscript|cscript|rundll32|regsvr32|mshta|whoami|net|net1|nltest|curl)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

Looks for: DNS for public blockchain RPC/gateway providers from a process that is not a sanctioned wallet/crypto app (the on-chain C2 resolve). FP: medium — allow-list sanctioned crypto apps; tune the provider list to current intel.

// HUNT: on-chain C2 resolution via blockchain RPC/gateway
// MITRE: T1102, T1071 | CONF: medium  FP: medium  COST: med
// TUNING: allow-list sanctioned wallet/crypto apps; tune the provider domain list
#event_simpleName=DnsRequest
| DomainName=/(infura\.io|alchemy\.com|ankr\.com|bsc-dataseed|binance\.org|cloudflare-eth\.com|llamarpc\.com|publicnode\.com|quiknode\.pro|drpc\.org)/i
| ContextBaseFileName!=/^(metamask|exodus|electrum|ledger.*|trust.*|coinbase.*)\.exe$/i
| table([@timestamp, ComputerName, ContextBaseFileName, DomainName], limit=200)

Looks for: Run keys / scheduled tasks pointing at an Obsidian copy in a user/temp path. FP: low-med — legit Obsidian auto-start is from its install dir, not a temp path.

// HUNT: persistence relaunching the side-loaded Obsidian
// MITRE: T1547.001, T1053.005 | CONF: med-high  FP: low-med  COST: low
// TUNING: legit auto-start is from the install dir; flag user/temp-path Obsidian
#event_simpleName=/AsepValueUpdate|ScheduledTaskRegistered|RegGenericValueUpdate/
| RegStringValue=/Obsidian\.exe/i
| RegStringValue=/\\(Temp|AppData|Downloads|Users\\Public|ProgramData)\\/i
| table([@timestamp, ComputerName, UserName, RegObjectName, RegStringValue], limit=200)

Looks for: outbound connections attributed to Obsidian.exe beyond its normal sync/update endpoints (RAT C2/exfil under cover). FP: medium — baseline Obsidian's legit sync/update hosts.

// HUNT: anomalous egress attributed to Obsidian.exe
// MITRE: T1071, T1041 | CONF: medium  FP: medium  COST: med
// TUNING: baseline Obsidian sync/update endpoints; flag the remainder
#event_simpleName=NetworkConnectIP4
| ImageFileName=/\\Obsidian\.exe$/i
| in(RemotePort, values=[443, 80, 8080, 8443])
| groupBy([ComputerName, RemoteAddressIP4, RemotePort], function=count())
| table([ComputerName, RemoteAddressIP4, RemotePort, _count], limit=200)