OceanLotus SPECTRALVIPER C2 Beacon via OneDrive.Sync.Services.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects network beaconing activity attributed to the OceanLotus (APT32) threat group, specifically the SPECTRALVIPER C2 mechanism. The rule identifies the 'OneDrive.Sync.Services.exe' process performing HTTP GET requests to known attacker-controlled infrastructure or using specific malicious cookie headers (zd_cs_pm, euconsent-v2) for command-and-control communication.