Sigma rule: OceanLotus Registry Activity

Rule

Title

OceanLotus Registry Activity

Status

test

Level

critical

Author

megan201296, Jonhnathan Ribeiro

Date

2019-04-14

Modified

2023-09-28

File

rules-emerging-threats/2018/TA/APT32-Oceanlotus/registry_event_apt_oceanlotus_registry.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects registry keys created in OceanLotus (also known as APT32) attacks

Log source

product

windows

category

registry_event

Detection

selection_clsid:
    TargetObject|contains: '\SOFTWARE\Classes\CLSID\{E08A0F4B-1F65-4D4D-9A09-BD4625B9C5A1}\Model'
selection_hkcu:
    TargetObject|contains:
        # HKCU\SOFTWARE\Classes\AppXc52346ec40fb4061ad96be0e6cb7d16a\
        - 'Classes\AppXc52346ec40fb4061ad96be0e6cb7d16a\'
        # HKCU\SOFTWARE\Classes\AppX3bbba44c6cae4d9695755183472171e2\
        - 'Classes\AppX3bbba44c6cae4d9695755183472171e2\'
        # HKCU\SOFTWARE\Classes\CLSID\{E3517E26-8E93-458D-A6DF-8030BC80528B}\
        - 'Classes\CLSID\{E3517E26-8E93-458D-A6DF-8030BC80528B}\'
        - 'Classes\CLSID\{E08A0F4B-1F65-4D4D-9A09-BD4625B9C5A1}\Model'
selection_appx_1:
    TargetObject|contains: '\SOFTWARE\App\'
selection_appx_2:
    TargetObject|contains:
        - 'AppXbf13d4ea2945444d8b13e2121cb6b663\'
        - 'AppX70162486c7554f7f80f481985d67586d\'
        - 'AppX37cc7fdccd644b4f85f4b22d5a3f105a\'
    TargetObject|endswith:
        - 'Application'
        - 'DefaultIcon'
condition: selection_clsid or selection_hkcu or all of selection_appx_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.persistence
• attack.defense-impairment
• attack.t1112
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1112

References

• https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/
• https://github.com/eset/malware-ioc/tree/master/oceanlotus

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2018/TA/APT32-Oceanlotus/registry_event_apt_oceanlotus_registry.yml