OceanLotus FireAnt MetaKit Trojanized Installer DLL Sideload

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects various indicators of DLL sideloading and process masquerading often associated with threat actor campaigns such as OceanLotus (APT32) and other malicious installers (FireAnt MetaKit). It monitors for specific DLL loads by unsigned or unexpected processes, the execution of masqueraded binaries, and suspicious command-line patterns used to stage malicious payloads.