Detects shellcode used to load Chrysalis backdoor, seen being used in the compromise of the infrastructure hosting Notep

Hunt Hypothesis

This hunt hypothesis targets adversaries executing custom shellcode to deploy the Chrysalis backdoor, a technique recently observed by the Chinese APT group Lotus Blossom during their compromise of Notepad++ infrastructure. Proactive hunting for this specific shellcode pattern in Azure Sentinel is critical to identify early-stage intrusions and prevent potential lateral movement or data exfiltration before the backdoor fully establishes its persistence mechanisms.

YARA Rule

rule MAL_Chrysalis_Shellcode_Loader_Feb26 {
   meta:
      description = "Detects shellcode used to load Chrysalis backdoor, seen being used in the compromise of the infrastructure hosting Notepad++ by Chinese APT group Lotus Blossom"
      author = "X__Junior"
      date = "2026-02-02"
      reference = "https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/"
      hash = "e2e3d78437cf9d48c2b2264e44bb36bc2235834fc45bbb50b5d6867f336711e3"
      score = 80
      id = "4dce8370-19d3-579a-b1c7-7dd9fbe51ee6"
   strings:
      $op1 = { 8B C7 03 D7 83 E0 ?? 47 8A 4C 05 ?? 8A 04 13 02 C1 32 C1 2A C1 88 02 8B 55 ?? 3B FE 7C ?? 8B 5D ?? 8B 45 }
      $op2 = { 03 F8 8B 45 ?? 8B 50 ?? 85 C9 79 ?? 0F B7 C1 EB ?? 8D 41 ?? 03 C3 50 FF 75 ?? FF D2 89 07 85 C0 74 ?? 8B 4D ?? 46 }
   condition:
      1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

False Positive Guidance

Here are 3-5 specific false positive scenarios for the Chrysalis Backdoor Shellcode Detection rule, tailored to an enterprise environment:

Scenario: Automated Deployment via PowerShell in CI/CD Pipelines
- Context: DevOps teams frequently use Jenkins or Azure DevOps agents to deploy updates. These pipelines often execute PowerShell scripts that dynamically generate and inject shellcode into memory to initialize custom deployment modules or load configuration blobs without writing files to disk (a technique mimicking the Chrysalis behavior).
- Filter/Exclusion: Exclude processes where the parent process is jenkins-agent.exe, vsts-task-runner.exe, or powershell.exe running under a specific service account (e.g., DOMAIN\DevOps-Svc) and the execution path matches known CI/CD working directories.
Scenario: Endpoint Detection and Response (EDR) Self-Healing Tasks
- Context: EDR solutions like CrowdStrike Falcon or Microsoft Defender for Endpoint often perform “self-healing” or “agent update” tasks that involve loading custom shellcode into memory to patch the agent itself. This activity can trigger the rule because the mechanism of injecting code directly into a process memory space is identical to the Chrysalis backdoor’s technique.
- Filter/Exclusion: Create an exclusion for processes with names containing CrowdStrike, FalconSensorService, or MsMpEng.exe when they are executing scheduled tasks defined in the Windows Task Scheduler (e.g., “Falcon Agent Update”) during maintenance windows.
Scenario: Scheduled Macro Execution in Office 365 Environments
- Context: Enterprise users often run complex VBA macros or custom add-ins within Microsoft Excel or Word that utilize COM automation to load external logic libraries. When these macros execute shellcode to render dynamic reports or connect