Windows Registry Modification: OracleOciLib/OracleOciLibPath Under MSDTC for oci.dll Redirection
Alerts on MSDTC MTxOCI registry changes to OracleOciLib/OracleOciLibPath that may redirect oci.dll loading to attacker-controlled locations.
- Product
- windows
- Category
- registry_set
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2026-01-24
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags registry value changes targeting the MSDTC MTxOCI keys for OracleOciLib and OracleOciLibPath. Adversaries can use these modifications to redirect how oci.dll is loaded, supporting DLL hijacking and defense-impairment by pointing to unexpected locations. It relies on registry set telemetry that includes the TargetObject path and Details content, specifically looking for deviations from expected oci.dll and %SystemRoot%\System32-based values.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry Modification: OracleOciLib/OracleOciLibPath Under MSDTC for oci.dll Redirection"
id: b56ab18d-352e-4aa4-8b2d-e20f139ca1dd
status: experimental
description: This rule flags registry value changes targeting the MSDTC MTxOCI keys for OracleOciLib and OracleOciLibPath. Adversaries can use these modifications to redirect how oci.dll is loaded, supporting DLL hijacking and defense-impairment by pointing to unexpected locations. It relies on registry set telemetry that includes the TargetObject path and Details content, specifically looking for deviations from expected oci.dll and %SystemRoot%\System32-based values.
references:
- https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_potential_oci_dll_redirection.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-01-24
tags:
- attack.persistence
- attack.privilege-escalation
- attack.execution
- attack.stealth
- attack.defense-impairment
- attack.t1112
- attack.t1574.001
logsource:
category: registry_set
product: windows
detection:
selection_ocilib:
TargetObject|endswith: \SOFTWARE\Microsoft\MSDTC\MTxOCI\OracleOciLib
filter_main_ocilib_file:
Details|contains: oci.dll
selection_ocilibpath:
TargetObject|endswith: \SOFTWARE\Microsoft\MSDTC\MTxOCI\OracleOciLibPath
filter_main_ocilibpath:
Details|contains: "%SystemRoot%\\System32\\"
condition: (selection_ocilib and not filter_main_ocilib_file) or (selection_ocilibpath and not filter_main_ocilibpath)
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: c0e0bdec-3e3d-47aa-9974-05539c999c89
type: derived