Lotus Blossom DLL Sideloading Activity
This detection rule identifies potential DLL sideloading activity associated with the Lotus Blossom threat actor's Chrysalis backdoor. It searches for specific legitimate executables, often renamed from security products, loading suspicious DLLs from the same directory. The rule specifically looks for `BluetoothService.exe` loading `log.dll` or `tmdbglog.exe` loading `tmdglog.dll`, where both the process and the DLL reside in the same directory.
Microsoft Sentinel (KQL)
