OceanLotus DLL Sideload via Autodesk/HP Toolbox.exe Masquerades with -uiDll

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

This rule detects potentially suspicious process creation or file modification activities associated with Autodesk applications or generic 'appcompat' paths. The detection logic flags processes executing with the '-uiDll' command-line argument and specific file operations (Creation/Modification) involving configuration or log files, often associated with unauthorized software tampering or suspicious binary execution patterns.