OceanLotus DLL Sideloading - SPECTRALVIPER/PHOREAL Masqueraded Loader Chain

Ibrahim Saud@tektrix

•updated Jun 30, 2026•4•0•2

Detects OceanLotus-related DLL sideloading and code injection techniques. This rule monitors for masqueraded executables (IntelAudioService, HP Toolbox variants) launched with suspicious flags (appmodel/StateRepository, -uiDll), the loading of the SPECTRALVIPER loader module (DtlCrashCatch.dll), and cross-process injection attempts from known malicious sideloading binaries.