Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
46 detections
Filters
Last updated
All Time
Detection languages
17
8
6
5
3
Contributors
22
6
5
5
3
Categories
24
8
8
6
4
Platforms
38
6
5
1
Products / Services
14
9
5
3
3
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
1
IDS Protocols
1
Detects the creation of suspicious, low-prevalence executable files (PE format) in user-writable directories (Temp, AppData, ProgramData) by processes commonly associated with cloud storage and synchronization services (e.g., OneDrive, Dropbox, Chrome, Edge). This activity mimics known TTPs attributed to the OceanLotus (APT32) group, specifically using these processes as hosts for staging or injecting malicious payloads. The rule filters out known legitimate paths for these applications to focus on anomalies.
Detects DLL sideloading patterns associated with OceanLotus (APT32), specifically targeting known sideloaded module filenames or legitimate processes loading modules from user-writable and non-standard directories using suspicious command-line flags.
This rule detects activities associated with the OceanLotus (APT32) supply-chain compromise, specifically targeting the SPECTRALVIPER loader chain. It identifies the masqueraded execution of 'IntelAudioService.exe' and specific sideloading carriers (AutoCad242.exe, Genuine.exe, Updater.exe) utilizing the '-uiDll' flag, the loading of the 'DtlCrashCatch.dll' malicious module, and network beaconing to known APT32 C2 infrastructure.
Detects network activity associated with the SPECTRALVIPER malware family attributed to OceanLotus (APT32). The rule monitors for connections to known malicious C2 infrastructure (IPs and domains) and behavioral anomalies where the 'OneDrive.Sync.Services.exe' process makes outbound network connections to non-private addresses, which is indicative of process injection.
Detects OceanLotus-related DLL sideloading and code injection techniques. This rule monitors for masqueraded executables (IntelAudioService, HP Toolbox variants) launched with suspicious flags (appmodel/StateRepository, -uiDll), the loading of the SPECTRALVIPER loader module (DtlCrashCatch.dll), and cross-process injection attempts from known malicious sideloading binaries.
Detects the creation of files associated with the SPECTRALVIPER malware, used by OceanLotus for DLL sideloading. This rule specifically monitors for known launcher executables (e.g., Genuine.exe, Updater.exe) and associated configuration/payload files (e.g., GlobalSettings.conf, appcompat.log) being dropped into directories commonly used for persistence or lateral movement, such as Autodesk and Windows appcompat folders.
Detects process execution patterns associated with OceanLotus (APT32) SPECTRALVIPER sideloading chains. The rule identifies suspicious executables by name (masquerading), specific command-line flags ('-uiDll'), execution from known staging directories, or binaries using spoofed vendor metadata with invalid or absent digital signatures.
This rule detects various indicators of DLL sideloading and process masquerading often associated with threat actor campaigns such as OceanLotus (APT32) and other malicious installers (FireAnt MetaKit). It monitors for specific DLL loads by unsigned or unexpected processes, the execution of masqueraded binaries, and suspicious command-line patterns used to stage malicious payloads.
Detects anomalous HTTP POST requests to the '/V1/Update/GetUpdate' endpoint on an MSSQL-hosted application, which is associated with malicious activity linked to the OceanLotus (APT32) threat actor group, specifically the Blazing Furnace campaign.
Detects a suspicious parent-child process relationship where IntelAudioService.exe spawns OneDrive.Sync.Services.exe or OneDrive.Sync.Service.exe. This activity is indicative of the SPECTRALVIPER backdoor injection utilized by the OceanLotus (APT32) group, specifically documented in their Blazing Furnace campaign, which leverages a DLL sideloading chain involving DtlCrashCatch.dll.
Detects a suspicious parent-child process relationship where IntelAudioService.exe spawns OneDrive.Sync.Services.exe or OneDrive.Sync.Service.exe. This activity is indicative of the SPECTRALVIPER backdoor injection utilized by the OceanLotus (APT32) group, specifically documented in their Blazing Furnace campaign, which leverages a DLL sideloading chain involving DtlCrashCatch.dll.
Detects specific DLL sideloading patterns associated with the OceanLotus (APT32) group, specifically involving the SPECTRALVIPER loader. The rule monitors for known masqueraded binaries (e.g., intelaudioservice.exe, genuine.exe) loading suspicious files or executing with specific command-line arguments (e.g., -uiDll, /appmodel) indicative of malicious sideloading and persistence mechanisms.
Detects suspected process injection activities characterized by specific OceanLotus sideloading binaries and SPECTRALVIPER-associated target processes. The rule monitors Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) for suspicious cross-process memory access, thread creation, and high-privilege access rights.
Detects HTTP POST requests directed to /V1/Update/GetUpdate, indicative of the OceanLotus downloader retrieving the next-stage payload (SPECTRALVIPER).
Detects DLL sideloading patterns associated with OceanLotus (APT32) SPECTRALVIPER campaigns. The rule monitors for specific process masquerading using IntelAudioService.exe or various toolbox executable variants (Genuine.exe, Updater.exe, AutoCAD242.exe) accompanied by suspicious command-line arguments or the loading of the known malicious module DtlCrashCatch.dll.
Detects DLL sideloading behavior associated with OceanLotus (APT32) where legitimate, signed executables (e.g., HP or Autodesk utilities) are renamed and executed with a -uiDll command-line parameter. The rule monitors both the process creation of these renamed executables in suspicious paths and subsequent image load events of DLLs with non-standard extensions, indicating the loading of malicious payloads.
Detects a specific DLL sideloading technique used by the threat group OceanLotus (APT32). The rule monitors for the execution of 'IntelAudioService.exe' with suspicious command-line arguments ('/appmodel', 'StateRepository', '/Service') indicative of an attempt to load a malicious DLL, 'DtlCrashCatch.dll', to initiate the SPECTRALVIPER backdoor execution.
Detects DLL sideloading behavior by the threat group OceanLotus (APT32), specifically targeting instances where legitimate Autodesk or HP Toolbox executables (Genuine.exe, Updater.exe, AutoCAD242.exe) are executed with the -uiDll command-line flag. This technique is used to load malicious DLLs (referred to as SPECTRALVIPER) from masqueraded, non-standard file paths such as %LOCALAPPDATA%\Autodesk or C:\Windows\appcompat, facilitating persistence and execution.
Detects the execution of IntelAudioService.exe (a common masquerade for dtlupdate.exe) which loads a malicious DtlCrashCatch.dll from an AppModel StateRepository directory, a technique historically associated with the OceanLotus (APT32) threat actor.
Detects network beaconing activity attributed to the OceanLotus (APT32) threat group, specifically the SPECTRALVIPER C2 mechanism. The rule identifies the 'OneDrive.Sync.Services.exe' process performing HTTP GET requests to known attacker-controlled infrastructure or using specific malicious cookie headers (zd_cs_pm, euconsent-v2) for command-and-control communication.
Detects OceanLotus (APT32) activity utilizing DLL sideloading by executing renamed variants of Toolbox.exe (e.g., AutoCad242.exe, Genuine.exe, Updater.exe) with the '-uiDll' command-line flag to load masqueraded payloads with extensions like .json, .conf, or .log.
Page 1 of 3