OceanLotus SPECTRALVIPER DLL Sideloading via Masqueraded Carrier Executables

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

This rule monitors for potential DLL sideloading by detecting specific known executable names loading suspicious modules such as 'dtlcrashcatch.dll' or 'setupui.dll'. It further validates the suspicion by analyzing command-line arguments for sideloading indicators (e.g., '-uidll', '/appmodel') or high-entropy arguments, and checking if the loaded module resides in the same directory as the host process, which is a common pattern for DLL sideloading.