OceanLotus SPECTRALVIPER Sideloading Payload Files on Disk

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the creation of files associated with the SPECTRALVIPER malware, used by OceanLotus for DLL sideloading. This rule specifically monitors for known launcher executables (e.g., Genuine.exe, Updater.exe) and associated configuration/payload files (e.g., GlobalSettings.conf, appcompat.log) being dropped into directories commonly used for persistence or lateral movement, such as Autodesk and Windows appcompat folders.