OceanLotus: Suspicious Child Process Spawned from FireAnt MetaKit Installer

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

This rule detects suspicious child process creation originating from 'setup.exe' (specifically with 'metakit' arguments) or 'IntelAudioService.exe' (specifically with sideloading-related arguments like '/appmodel', '/StateRepository', and '/Service'). These indicators are commonly associated with the SPECTRALVIPER threat activity, where legitimate-looking processes are abused to launch secondary, potentially malicious tools like cmd, powershell, or other system utilities.