OceanLotus SPECTRALVIPER DLL Sideload via IntelAudioService.exe and DtlCrashCatch.dll

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects suspicious activity involving 'IntelAudioService.exe' and the potential sideloading of 'DtlCrashCatch.dll'. It flags instances where 'DtlCrashCatch.dll' is loaded as a module or when 'IntelAudioService.exe' is executed with specific command-line arguments (e.g., 'appmodel', 'staterepository', 'service') that may indicate abnormal service behavior or potential sideloading attempts.