OceanLotus SPECTRALVIPER DLL Sideload via IntelAudioService.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects a specific DLL sideloading technique used by the threat group OceanLotus (APT32). The rule monitors for the execution of 'IntelAudioService.exe' with suspicious command-line arguments ('/appmodel', 'StateRepository', '/Service') indicative of an attempt to load a malicious DLL, 'DtlCrashCatch.dll', to initiate the SPECTRALVIPER backdoor execution.