Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12 detections
Filters
Last updated
All Time
Detection languages
6
3
2
1
Contributors
3
2
2
2
1
Categories
6
4
3
2
2
Platforms
11
1
1
1
Products / Services
5
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects the creation or modification of a Windows service named 'BluetoothService' where its executable path points to a non-standard, user-writable location (e.g., AppData, Temp, ProgramData). This technique is often used by malware, such as the Chrysalis backdoor in the Lotus Blossom campaign, to establish persistence and evade detection by masquerading as a legitimate system service.
This is a broad hunting query to find Indicators of Compromise (IOCs) associated with the Notepad++ supply-chain attack attributed to the Lotus Blossom actor and the Chrysalis backdoor. It searches for known file hashes, file paths, network indicators (IPs, domains, URLs), and user-agents across multiple event types.
Detects the execution or loading of the Tiny C Compiler (TCC) runtime (libtcc.dll, tcc.exe) by non-development processes. This 'living-on-edge' compilation technique, observed in use by actors like Lotus Blossom, helps bypass static file-based detections by compiling malicious code directly on the host.
SPL Query
Detects the Notepad++ updater process (GUP.exe) spawning a child process named 'update.exe'. This behavior was observed during the Lotus Blossom supply chain attack where the Notepad++ update infrastructure was compromised to deliver the Chrysalis backdoor.
This rule detects activity related to the Chrysalis Backdoor, which is associated with the Lotus Blossom threat group. It identifies malicious activity through three main components: 1. File and process events matching a list of known malicious SHA256 hashes. 2. Network connections to known malicious IP addresses or domains. 3. Suspicious execution of 'svchost.exe' from non-standard Windows directories with specific command-line arguments, indicating potential masquerading or malicious execution.
This detection rule identifies potential DLL sideloading activity associated with the Lotus Blossom threat actor's Chrysalis backdoor. It searches for specific legitimate executables, often renamed from security products, loading suspicious DLLs from the same directory. The rule specifically looks for `BluetoothService.exe` loading `log.dll` or `tmdbglog.exe` loading `tmdglog.dll`, where both the process and the DLL reside in the same directory.
Chrysalis Backdoor SHA256 Hash Detection
Cortex XDR
This rule detects the presence or execution of the Chrysalis Backdoor by matching known SHA256 hashes of its components. It monitors file and process events for these specific hashes.
Chrysalis Backdoor Network IOCs
Cortex XDR
Detects network connections to known command and control (C2) infrastructure associated with the Lotus Blossom threat group and the Chrysalis Backdoor. This rule identifies suspicious outbound network activity to specific IP addresses and hostnames linked to this threat actor.
Detects Elise backdoor activity used by APT32
Detects Elise backdoor activity used by APT32
Detects Elise backdoor activity, specifically looking for the creation of a svchost.exe process in a suspicious path and the deletion of a NavShExt.dll file, which are indicators of the Elise malware used by APT32.
