Procedure examples

Lotus Blossom has run commands such as `reg query HKLM\SYSTEM\CurrentControlSet\Services\[service name]\Parameters` to verify if installed implants are running as a service.

Lotus Blossom has used commands such as `ipconfig` and `netstat` to gather network information on compromised hosts.

Lotus Blossom has performed checks to determine if a victim machine is able to access the Internet.

Lotus Blossom has used Ping to identify remote systems.

Lotus Blossom has used port scanners to enumerate services on remote hosts.

Lotus Blossom has used WMI to enable lateral movement.

Lotus Blossom has used commands such as `netstat` to identify system network connections.

Lotus Blossom has locally staged compressed and archived data for follow-on exfiltration.

Lotus Blossom has used commands such as `dir` to examine the local filesystem of victim machines.

Lotus Blossom has used commands such as `net` to profile local system users.

Lotus Blossom has used `net` commands and tools such as AdFind to profile domain accounts associated with victim machines and make Active Directory queries.

Lotus Blossom has used publicly available tools such as the Venom proxy tool to proxy traffic out of victim environments.

Lotus Blossom has used tools such as the publicly available HTran tool for proxying traffic in victim environments.

Lotus Blossom has installed tools such as Sagerunex by writing them to the Windows registry.

Lotus Blossom has retrieved process tokens for processes to adjust the privileges of the launch process or other items.

Lotus Blossom has used tools such as AdFind to make Active Directory queries.

Lotus Blossom has used publicly-available tools to steal cookies from browsers such as Chrome.

Lotus Blossom has configured tools such as Sagerunex to run as Windows services.

Lotus Blossom has used WinRAR for compressing data in RAR format.

Lotus Blossom has used custom tools to compress and archive data on victim systems.

Lotus Blossom has used publicly-available tools such as a Python-based cookie stealer for Chrome browsers, Impacket, and the Venom proxy tool.