OceanLotus SPECTRALVIPER Sideloading via IntelAudioService.exe / DtlCrashCatch.dll
Detects DLL sideloading patterns associated with OceanLotus (APT32) SPECTRALVIPER campaigns. The rule monitors for specific process masquerading using IntelAudioService.exe or various toolbox executable variants (Genuine.exe, Updater.exe, AutoCAD242.exe) accompanied by suspicious command-line arguments or the loading of the known malicious module DtlCrashCatch.dll.
SentinelOne
