OceanLotus Ingress Tool Transfer: PE Written to Temp/AppData by Cloud-Sync Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•6

Detects the creation of suspicious, low-prevalence executable files (PE format) in user-writable directories (Temp, AppData, ProgramData) by processes commonly associated with cloud storage and synchronization services (e.g., OneDrive, Dropbox, Chrome, Edge). This activity mimics known TTPs attributed to the OceanLotus (APT32) group, specifically using these processes as hosts for staging or injecting malicious payloads. The rule filters out known legitimate paths for these applications to focus on anomalies.