OysterLoader DLL Dropped in AppData Roaming

Daniel Jeremiah@daniyyell

•updated Feb 20, 2026•1•0•27

This rule detects the dropping of specific DLL files associated with OysterLoader malware within the 'AppData\Roaming' directory. The detection logic specifically looks for file creation events where the target filename contains 'AppData\Roaming' and one of the following strings: 'COPYING3.dll', 'VisualUpdater', 'AlphaSecurity', or 'DetectorSpywareSecurity'. This activity is indicative of a stage 3 drop by OysterLoader before a scheduled task is created, as detailed in a Sekoia report.