SUSP_Renamed_Bitdefender_Submission_Wizard_Feb26

rule SUSP_Renamed_Bitdefender_Submission_Wizard_Feb26 {
   meta:
      description = "Detects renamed Bitdefender Submission Wizard, seen being used in the compromise of the infrastructure hosting Notepad++ by Chinese APT group Lotus Blossom"
      author = "X__Junior"
      reference = "https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/"
      date = "2026-02-03"
      score = 65
      hash1 = "2da00de67720f5f13b17e9d985fe70f10f153da60c9ab1086fe58f069a156924"
      id = "1c5e0314-8ced-5680-92eb-df03cc4e5847"
   strings:
      $s1 = "BDSubWiz.exe" wide fullword
      $s2 = "Bitdefender Submission Wizard" wide
      $s3 = "Software\\Bitdefender" wide
   condition:
      uint16(0) == 0x5a4d
      and all of ($s*)
      and not filename == "BDSubWiz.exe"
}