Registry Modification for OCI DLL Redirection

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•5

Detects registry modifications related to 'OracleOciLib' and 'OracleOciLibPath' under 'MSDTC' settings. Threat actors may modify these registry keys to redirect the loading of 'oci.dll' to a malicious DLL, facilitating phantom DLL hijacking via the MSDTC service.