OceanLotus SPECTRALVIPER DLL Sideloading via -uiDll Flag or IntelAudioService
This rule detects potential DLL sideloading activity linked to the threat group OceanLotus (APT32). It specifically monitors for the execution of 'IntelAudioService.exe' with specific arguments indicative of loading the SpectralViper implant, as well as the execution of known legitimate but abused binaries (AutoCad242.exe, Genuine.exe, Updater.exe) utilizing the '-uiDll' command-line flag to load malicious DLLs.
YARA-L
