Windows Registry: Create/Modify CLSID/AppX keys associated with OceanLotus decoy paths
OceanLotus Registry Activity
FreeReviewedSigma · Critical · v3
- Product
- windows
- Category
- registry_event
- Author
- megan201296, Jonhnathan Ribeiro (SigmaHQ), DRL 1.1
- Published
- 2019-04-14
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows registry activity where TargetObject contains specific CLSID and AppX key paths tied to OceanLotus decoy locations. Attackers may create or modify these registry entries to establish persistence, influence application behavior, or impair defenses by using believable system-like identifiers. It relies on Windows registry event telemetry and matches on the registry key path contained in TargetObject.
Reporting behind it
- welivesecurity.comhttps://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/
- github.comhttps://github.com/eset/malware-ioc/tree/master/oceanlotus
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/TA/APT32-Oceanlotus/registry_event_apt_oceanlotus_registry.yml
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
oceanlotus-registry-activity-4ac5fc44
title: "Windows Registry: Create/Modify CLSID/AppX keys associated with OceanLotus decoy paths"
id: 9a2a8c42-4e0e-43cc-b2b0-66e83a8c7316
status: test
description: This rule flags Windows registry activity where TargetObject contains specific CLSID and AppX key paths tied to OceanLotus decoy locations. Attackers may create or modify these registry entries to establish persistence, influence application behavior, or impair defenses by using believable system-like identifiers. It relies on Windows registry event telemetry and matches on the registry key path contained in TargetObject.
references:
- https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/
- https://github.com/eset/malware-ioc/tree/master/oceanlotus
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/TA/APT32-Oceanlotus/registry_event_apt_oceanlotus_registry.yml
author: megan201296, Jonhnathan Ribeiro, Huntrule Team
date: 2019-04-14
modified: 2023-09-28
tags:
- attack.persistence
- attack.defense-impairment
- attack.t1112
- detection.emerging-threats
logsource:
category: registry_event
product: windows
detection:
selection_clsid:
TargetObject|contains: \SOFTWARE\Classes\CLSID\{E08A0F4B-1F65-4D4D-9A09-BD4625B9C5A1}\Model
selection_hkcu:
TargetObject|contains:
- Classes\AppXc52346ec40fb4061ad96be0e6cb7d16a\
- Classes\AppX3bbba44c6cae4d9695755183472171e2\
- Classes\CLSID\{E3517E26-8E93-458D-A6DF-8030BC80528B}\
- Classes\CLSID\{E08A0F4B-1F65-4D4D-9A09-BD4625B9C5A1}\Model
selection_appx_1:
TargetObject|contains: \SOFTWARE\App\
selection_appx_2:
TargetObject|contains:
- AppXbf13d4ea2945444d8b13e2121cb6b663\
- AppX70162486c7554f7f80f481985d67586d\
- AppX37cc7fdccd644b4f85f4b22d5a3f105a\
TargetObject|endswith:
- Application
- DefaultIcon
condition: selection_clsid or selection_hkcu or all of selection_appx_*
falsepositives:
- Unknown
level: critical
license: DRL-1.1
related:
- id: 4ac5fc44-a601-4c06-955b-309df8c4e9d4
type: derived