Windows Registry Modification: OracleOciLib/OracleOciLibPath Under MSDTC for oci.dll Redirection

title: "Windows Registry Modification: OracleOciLib/OracleOciLibPath Under MSDTC for oci.dll Redirection"
id: b56ab18d-352e-4aa4-8b2d-e20f139ca1dd
status: experimental
description: This rule flags registry value changes targeting the MSDTC MTxOCI keys for OracleOciLib and OracleOciLibPath. Adversaries can use these modifications to redirect how oci.dll is loaded, supporting DLL hijacking and defense-impairment by pointing to unexpected locations. It relies on registry set telemetry that includes the TargetObject path and Details content, specifically looking for deviations from expected oci.dll and %SystemRoot%\System32-based values.
references:
  - https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_potential_oci_dll_redirection.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-01-24
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.defense-impairment
  - attack.t1112
  - attack.t1574.001
logsource:
  category: registry_set
  product: windows
detection:
  selection_ocilib:
    TargetObject|endswith: \SOFTWARE\Microsoft\MSDTC\MTxOCI\OracleOciLib
  filter_main_ocilib_file:
    Details|contains: oci.dll
  selection_ocilibpath:
    TargetObject|endswith: \SOFTWARE\Microsoft\MSDTC\MTxOCI\OracleOciLibPath
  filter_main_ocilibpath:
    Details|contains: "%SystemRoot%\\System32\\"
  condition: (selection_ocilib and not filter_main_ocilib_file) or (selection_ocilibpath and not filter_main_ocilibpath)
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: c0e0bdec-3e3d-47aa-9974-05539c999c89
    type: derived