SPECTRALVIPER OneDrive.Sync.Services.exe Masquerade C2 Staging

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects SPECTRALVIPER threat activity by monitoring for unauthorized masquerading as legitimate OneDrive sync processes. The rule identifies suspicious process creation, beaconing to C2 infrastructure, DtlCrashCatch.dll sideloading, and unauthorized cross-process injection behaviors associated with this threat actor.