Chrysalis Backdoor Detection – Lotus Blossom
This rule detects activity associated with the Chrysalis backdoor used by the Lotus Blossom threat group. It correlates multiple high-confidence indicators to identify potential compromise. The detection focuses on three key behaviours: Known malicious artifacts File and process activity where the SHA256 hash matches confirmed Chrysalis malware samples. Malicious network communications Outbound connections to known Chrysalis command-and-control IP addresses or domains. Suspicious svchost execution Execution of svchost.exe from non-standard Windows directories, combined with unusual command-line arguments such as -nostdlib and -run, strongly suggests masquerading or malicious payload execution.
Microsoft Sentinel (KQL)
