Vamshi B
@Vamshi7890 followers1 download16 copies1 like128 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
1
1
1
1
Platforms
1
Products / Services
1
MITRE Techniques
1
1
1
1
1
This rule detects activity associated with the Chrysalis backdoor used by the Lotus Blossom threat group. It correlates multiple high-confidence indicators to identify potential compromise.
The detection focuses on three key behaviours:
Known malicious artifacts
File and process activity where the SHA256 hash matches confirmed Chrysalis malware samples.
Malicious network communications
Outbound connections to known Chrysalis command-and-control IP addresses or domains.
Suspicious svchost execution
Execution of svchost.exe from non-standard Windows directories, combined with unusual command-line arguments such as -nostdlib and -run, strongly suggests masquerading or malicious payload execution.
The detection focuses on three key behaviours:
Known malicious artifacts
File and process activity where the SHA256 hash matches confirmed Chrysalis malware samples.
Malicious network communications
Outbound connections to known Chrysalis command-and-control IP addresses or domains.
Suspicious svchost execution
Execution of svchost.exe from non-standard Windows directories, combined with unusual command-line arguments such as -nostdlib and -run, strongly suggests masquerading or malicious payload execution.
