OceanLotus SPECTRALVIPER/WINDSHIELD Lateral Tool Transfer via SMB or PsExec

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects lateral movement activity and implant deployment patterns associated with the threat group OceanLotus (APT32). It monitors for the creation of specific suspicious files and paths often used by SPECTRALVIPER/WINDSHIELD malware, identifies file transfers over SMB orchestrated by system processes, tracks the execution of remote administration tools like PsExec, and identifies internal pivot activity via named pipes.