oceanlotus-apt32-network

This query was originally published in a threat analytics report about the group known to other security researchers as APT32 or OceanLotus This tracked activity group uses a wide array of malicious documents to conduct attacks. Some of their favored techniques include sideloading dynamic link libraries, and disguising payloads as image files. The following query detects network activity that may indicate an attack by this group. See Detect malicious documents associated with group known as "OceanLotus" for another query related to this group's activity.