OceanLotus Registry Activity Detection

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•23

This rule detects the creation or modification of specific registry keys that have been observed in attacks attributed to the OceanLotus (also known as APT32) threat group. The rule specifically looks for patterns in `TargetObject` paths related to CLSID entries and `AppX` entries within `HKCU\SOFTWARE\Classes` and `HKCU\SOFTWARE\App`.