OceanLotus SPECTRALVIPER Lateral Tool Transfer via Admin Share Exec Chain

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects the creation or modification of executable files (.exe or .dll) on hidden Windows administrative shares (e.g., ADMIN$, C$, D$, IPC$), followed by the execution of a process with the same file hash on a different host within a one-hour window. This behavior is indicative of lateral movement using SMB shares to stage and execute malicious payloads.