OceanLotus DLL Sideload via Genuine.exe/Updater.exe/AutoCad242.exe with -uiDll flag

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects DLL sideloading behavior associated with OceanLotus (APT32) where legitimate, signed executables (e.g., HP or Autodesk utilities) are renamed and executed with a -uiDll command-line parameter. The rule monitors both the process creation of these renamed executables in suspicious paths and subsequent image load events of DLLs with non-standard extensions, indicating the loading of malicious payloads.