Lotus Blossom : Sagerunex backdoor

[Basile-Professional]

Local setup

Need a target machine
Find a way to do exfiltration using the Lotus Blossom Techniques
capture the process with tcpdump
find a way to spot it though the pcap

External sources

https://www.notion.so/trout-software/Lotus-Blossom-1a6f9f8a093980bf93a5d09a13860d89
https://blog.talosintelligence.com/lotus-blossom-espionage-group/

[Basile-Professional]

find out that obviously the commands being local it is impossible to spot them with snort

[Basile-Professional]

could be with audit.d but it is for windows and not linux