Detects Chrysalis backdoor, seen being used in the compromise of the infrastructure hosting Notepad++ by Chinese APT gro

Hunt Hypothesis

This hunt hypothesis targets adversaries deploying the Chrysalis backdoor to establish persistent access within cloud infrastructure, mirroring the tactics observed in the Notepad++ compromise by a Chinese APT group. Proactive hunting for this signature in Azure Sentinel is essential to identify early-stage lateral movement and data exfiltration attempts before they escalate into critical breaches of sensitive host environments.

YARA Rule

rule MAL_Chrysalis_Backdoor_Feb26 {
   meta:
      description = "Detects Chrysalis backdoor, seen being used in the compromise of the infrastructure hosting Notepad++ by Chinese APT group Lotus Blossom"
      author = "X__Junior"
      date = "2026-02-02"
      reference = "https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/"
      hash = "e2e3d78437cf9d48c2b2264e44bb36bc2235834fc45bbb50b5d6867f336711e3"
      score = 80
      id = "c3621431-9e20-5497-ad0a-e371063e7656"
   strings:
      $opa1 = { 8B 4D ?? C1 CF ?? C1 C1 ?? 03 F9 D1 C3 8B 4D ?? C1 C1 ?? 03 F9 03 FB 8B 5D ?? 69 CF ?? ?? ?? ?? BF ?? ?? ?? ?? 2B F9 EB }
      $opa2 = { F7 E9 [0-1] 8B C2 C1 E8 ?? 03 C2 8D 0C 40 8A C3 34 ?? [0-2] 0F B6 [1-4] 0F B6 C3 8B 5D [1-3] 0F 45 D0 }

      $opb1 = { 0F B6 84 35 ?? ?? ?? ?? 88 84 3D ?? ?? ?? ?? 88 8C 35 ?? ?? ?? ?? 0F B6 84 3D ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 03 C2 0F B6 C0 0F B6 84 05 ?? ?? ?? ?? 30 04 19 43 3B 9D ?? ?? ?? ?? 7C }
   condition:
      (1 of ($opa*) and $opb1)
      or
      all of ($opa*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chrysalis Backdoor detection rule, tailored to an enterprise environment using legitimate administrative and development workflows:

• Scenario: Legitimate Software Deployment via Microsoft Endpoint Configuration Manager (SCCM)

  • Context: During a scheduled patching window, SCCM deploys a new application package that includes a bundled installer or runtime library containing the specific Chrysalis signature pattern. The deployment agent extracts files to a temporary directory (C:\Windows\CCMCache) which triggers the rule before the final installation completes.
  • Suggested Filter/Exclusion: Exclude file paths matching C:\Windows\CCMCache\* and process names ccmsetup.exe or wuauserv.exe when running under the context of a known SCCM deployment job ID.

• Scenario: Automated Build Pipelines in Azure DevOps or Jenkins

  • Context: A CI/CD pipeline executes a build step that compiles source code and generates intermediate artifacts. The build agent (running on a Linux or Windows VM) extracts a dependency archive containing the Chrysalis signature pattern during the “Restore” phase, mimicking the backdoor’s extraction behavior.
  • Suggested Filter/Exclusion: Create an exclusion for processes running under service accounts named AZP-Service, Jenkins-Agent-*, or TFSBuildAgent when they are accessing directories within the build workspace (e.g., D:\Builds\*).

• Scenario: Scheduled Antivirus or EDR Heuristic Scans

  • Context: The enterprise Endpoint Detection and Response (EDR) solution, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, performs a deep heuristic scan of the system drive. During this scan, the engine unpacks compressed archives (e.g., `.zip