THREATOPS

THREAT OPS › Threat News › Speeding APT Attack Confirmation with Attack Discovery, Workflows, and Agent Builder

Speeding APT Attack Confirmation with Attack Discovery, Workflows, and Agent Builder

lowelastic_securityPublished 2026-02-18

9:15 AM: The Non-Event - A headline breaks: "<a href="https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/">Chrysalis Backdoor: A Deep Dive into Lotus Blossom</a>." Your CISO sends a Slack message: "Are we affected?" In a traditional SOC, you’re about to lose your entire morning to a manual scramble - sifting through dozens of alerts,

Attributed threat actors

Lotus BlossomG0030

MITRE ATT&CK techniques

ServerlessT1583.007
DNST1071.004
Malicious FileT1204.002
Windows ServiceT1543.003
Supply Chain CompromiseT1195
Compromise Software Supply ChainT1195.002
ServerlessT1584.007
ServerlessAML.T0008.004

Indicators of compromise

https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/url
https://<your-kibana-url>/app/agent_builder/conversations/<conversation-id&gturl
api.skycloudcenter.comdomain
static-www.elastic.codomain

Original source: https://www.elastic.co/security-labs/blog/speeding-apt-attack-discovery-confirmation-with-attack-discovery-workflows-and-agent-builder