Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
46 detections
Filters
Last updated
All Time
Detection languages
17
8
6
5
3
Contributors
22
6
5
5
3
Categories
24
8
8
6
4
Platforms
38
6
5
1
Products / Services
14
9
5
3
3
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects evidence of process injection techniques associated with the OceanLotus (APT32) threat group, specifically the SPECTRALVIPER backdoor or related tools from the Blazing Furnace campaign. The rule monitors for unauthorized code injection into legitimate host processes (e.g., OneDrive, IntelAudioService) using common Windows API patterns (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread).
This rule detects potential DLL sideloading activity linked to the threat group OceanLotus (APT32). It specifically monitors for the execution of 'IntelAudioService.exe' with specific arguments indicative of loading the SpectralViper implant, as well as the execution of known legitimate but abused binaries (AutoCad242.exe, Genuine.exe, Updater.exe) utilizing the '-uiDll' command-line flag to load malicious DLLs.
Detects pip installing the benign-looking termncolor package together with colorinal. This dependency relationship was used to conceal delivery of platform-specific ZiChatBot droppers, as observed in campaigns attributed to OceanLotus (APT32). The rule specifically looks for command-line executions of pip or python with 'pip install' and the presence of 'termncolor', 'colorinal', or 'uuid32-utils' in the command line.
Detects HTTP POST requests directed to /V1/Update/GetUpdate, indicative of the OceanLotus downloader retrieving the next-stage payload (SPECTRALVIPER).
Detects Python processes that import 'unicode.py' and attempt to load 'terminate.dll' during an 'is_color_supported' call. This behavior is indicative of the ZiChatBot dropper, which uses this deceptive function to trigger its malicious payload.
Detects a loader command or memory-scanning utility referencing the Policy.dllcppage.dll marker that ZiChatBot replaces with its terminate.dll path. This rule specifically looks for process command lines containing both 'Policy.dllcppage.dll' and 'terminate.dll' executed by processes with filenames like python, rundll32, vcpktsvr, or loader.
Detects the Python wrapper and native dropper deleting their own unicode.py and terminate.dll components after the payload has been unpacked. The rule specifically looks for file deletion events where the target file name matches 'unicode.py' or 'terminate.dll' within common application data directories (site-packages, dist-packages, AppData, Temp) and the command line contains deletion-related keywords.
Detects the creation, renaming, or modification of 'vcpktsvr.exe' and 'libcef.dll' within a directory path containing '\vcpacket'. The rule specifically looks for the co-occurrence of both files within a 10-minute window on the same device, indicating the presence of the Windows ZiChatBot malware stage, which is known to use DLL side-loading.
Detects executions of specific renamed binaries (Genuine.exe, Updater.exe, AutoCAD242.exe) or the original Toolbox.exe utilizing the '-uiDll' flag. This is indicative of DLL side-loading behavior abused by OceanLotus to deploy the SPECTRALVIPER backdoor.
Detects network traffic matching the specific HTTP GET request URI used by the OceanLotus SPECTRALVIPER backdoor for command and control beaconing.
Detects process injection attempts targeting the OneDrive.Sync.Service.exe process. This behavior is associated with the OceanLotus SPECTRALVIPER backdoor, which uses it to maintain persistence and evade defense mechanisms.
Detects HTTP requests where the Cookie header contains the specific prefixes 'euconsent-v2=' or 'zd_cs_pm=', which are used by the OceanLotus SPECTRALVIPER backdoor to exfiltrate encrypted host profiling data.
Detects the execution of IntelAudioService.exe (a renamed dtlupdate.exe) using specific command-line arguments to side-load the SPECTRALVIPER backdoor. This activity is associated with OceanLotus (APT32) operations targeting Vietnam.
Detects network connections to known Command and Control (C2) infrastructure (domain or IP) associated with the Chrysalis backdoor, used in the Notepad++ supply chain attack.
Detects the XOR decryption function used in macOS variants of OceanLotus (APT32). This rule targets a specific byte sequence identified in the malware's decryption routine.
This rule detects the creation or modification of specific registry keys that have been observed in attacks attributed to the OceanLotus (also known as APT32) threat group. The rule specifically looks for patterns in `TargetObject` paths related to CLSID entries and `AppX` entries within `HKCU\SOFTWARE\Classes` and `HKCU\SOFTWARE\App`.
Detects Elise backdoor activity used by APT32
Backdoor processes associated with OceanLotus Mac Malware Backdoor.
References:.
Https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/.
OS platforms: Macintosh.
References:.
Https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/.
OS platforms: Macintosh.
Backdoor processes associated with OceanLotus Mac malware backdoor dropper.
References:.
Https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/.
OS Platforms: Macintosh.
References:.
Https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/.
OS Platforms: Macintosh.
Detects Elise backdoor activity used by APT32
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_oceanlotus_registry.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
Page 2 of 3