splunk · MHaggis · Feb 2, 2026
diff --git a/datasets/attack_techniques/T1059.005/lotus_blossom_chrysalis/dataset.yml b/datasets/attack_techniques/T1059.005/lotus_blossom_chrysalis/dataset.yml
@@ -0,0 +1,13 @@
+author: Michael Haag, Splunk
+id: 5010d236-00a5-434f-bfeb-20af07d478aa
+date: '2026-02-02'
+description: Lotus Blossom TinyCC shellcode execution simulation. Svchost.exe executed with TinyCC compiler flags (-nostdlib -run) to simulate Chrysalis backdoor's shellcode compilation technique.
+environment: attack_range
+directory: lotus_blossom_chrysalis
+mitre_technique:
+- T1059.005
+datasets:
+- name: windows-sysmon.log
+  path: /datasets/attack_techniques/T1059.005/lotus_blossom_chrysalis/windows-sysmon.log
+  sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
diff --git a/datasets/attack_techniques/T1059.005/lotus_blossom_chrysalis/windows-sysmon.log b/datasets/attack_techniques/T1059.005/lotus_blossom_chrysalis/windows-sysmon.log
diff --git a/datasets/attack_techniques/T1543.003/lotus_blossom_chrysalis/dataset.yml b/datasets/attack_techniques/T1543.003/lotus_blossom_chrysalis/dataset.yml
@@ -0,0 +1,13 @@
+author: Michael Haag, Splunk
+id: bfab9adc-3767-487a-87cd-35f1a7cd8706
+date: '2026-02-02'
+description: Lotus Blossom BluetoothService persistence test execution. Service created in user AppData directory for persistence.
+environment: attack_range
+directory: lotus_blossom_chrysalis
+mitre_technique:
+- T1543.003
+datasets:
+- name: windows-system.log
+  path: /datasets/attack_techniques/T1543.003/lotus_blossom_chrysalis/windows-system.log
+  sourcetype: XmlWinEventLog:System
+  source: XmlWinEventLog:System
diff --git a/datasets/attack_techniques/T1543.003/lotus_blossom_chrysalis/windows-system.log b/datasets/attack_techniques/T1543.003/lotus_blossom_chrysalis/windows-system.log
diff --git a/datasets/attack_techniques/T1574.002/lotus_blossom_chrysalis/dataset.yml b/datasets/attack_techniques/T1574.002/lotus_blossom_chrysalis/dataset.yml
@@ -0,0 +1,13 @@
+author: Michael Haag, Splunk
+id: 66eb3815-e429-4bc2-a8f1-e3ea8bc7e8c2
+date: '2026-02-02'
+description: Lotus Blossom Bitdefender DLL side-loading test execution. Rundll32.exe loading malicious log.dll from user directory mimicking Bitdefender Submission Wizard abuse.
+environment: attack_range
+directory: lotus_blossom_chrysalis
+mitre_technique:
+- T1574.002
+datasets:
+- name: windows-sysmon.log
+  path: /datasets/attack_techniques/T1574.002/lotus_blossom_chrysalis/windows-sysmon.log
+  sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
diff --git a/datasets/attack_techniques/T1574.002/lotus_blossom_chrysalis/windows-sysmon.log b/datasets/attack_techniques/T1574.002/lotus_blossom_chrysalis/windows-sysmon.log