OceanLotus SPECTRALVIPER Remote Thread Injection into Legitimate Host Processes

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects suspected process injection activities characterized by specific OceanLotus sideloading binaries and SPECTRALVIPER-associated target processes. The rule monitors Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) for suspicious cross-process memory access, thread creation, and high-privilege access rights.