Detects BRICKSTORM backdoor used by APT group UNC5221 (China Nexus)

Hunt Hypothesis

This hunt hypothesis targets the deployment of the BRICKSTORM backdoor, a sophisticated tool employed by the China Nexus APT group to establish persistent access and conduct long-term reconnaissance within compromised networks. Proactively hunting for this indicator in Azure Sentinel is critical due to its high severity classification, enabling the SOC team to identify early-stage intrusions before adversaries can leverage the backdoor for data exfiltration or lateral movement.

YARA Rule

rule MAL_G_APT_Backdoor_BRICKSTORM_1 {
   meta:
      description = "Detects BRICKSTORM backdoor used by APT group UNC5221 (China Nexus)"
      author = "Google Threat Intelligence Group (GTIG) (modified by Florian Roth)"
      date = "2025-09-25"
      score = 75
      reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
      md5 = "4645f2f6800bc654d5fa812237896b00"
      id = "0e56b78c-121d-5ee5-ad3a-103088ecafeb"
   strings:
      $ = "WRITE_LOGWednesday"
      $ = "/home/vsphere-ui/"
      $ = "WRITE_LOG=true"
      $ = "dns rcode: %v"
      $ = "/libs/doh.createDnsMessage"
      $ = "/libs/func1.(*Client).BackgroundRun"
      $ = "/libs/func1.CreateClient"
      $ = "/core/extends/command.CommandNoContext"
      $ = "/core/extends/command.ExecuteCmd"
      $ = "/core/extends/command.RunShell"
      $ = "/libs/fs.(*RemoteDriver).DeleteFile"
      $ = "/libs/fs.(*RemoteDriver).GetFile"
      $ = "/libs/fs.(*RemoteDriver).PutFile"
      $ = "/libs/doh/doh.go"
   condition:
      uint32(0) == 0x464c457f and 5 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

References

• https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the BRICKSTORM backdoor detection rule, tailored for a legitimate enterprise environment:

• Scenario: Automated Deployment of Microsoft System Center Configuration Manager (SCCM) or Intune

  • Context: The BRICKSTORM backdoor is known to utilize PowerShell and specific registry modifications for persistence. Enterprise environments often use SCCM/Intune to push policy updates, software installations, or script executions via msiexec or powershell.exe, which can mimic the file creation and registry key changes associated with the APT’s initial infection phase.
  • Suggested Filter: Exclude alerts where the parent process is ccmsetup.exe (SCCM) or IntuneManagementExtension.exe, and the user context is a managed service account (e.g., DOMAIN\SCCM-Service) rather than an interactive user session.

• Scenario: Scheduled Maintenance of Endpoint Detection and Response (EDR) Agents

  • Context: Many EDR solutions (such as CrowdStrike Falcon, Carbon Black, or Microsoft Defender for Endpoint) perform scheduled self-healing tasks that involve injecting code into system processes and modifying the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options registry keys. This behavior closely resembles the backdoor’s mechanism for process injection and persistence.
  • Suggested Filter: Create an exclusion based on the specific hash of known EDR agent binaries (e.g., falcon.sys, ccService.exe) executing scheduled tasks named “Agent Health Check” or “Signature Update,” specifically during off-hours (02:00–04:00 local time).

• Scenario: Legitimate PowerShell Script Execution for IT Asset Management

  • Context: The BRICKSTORM backdoor frequently leverages the powershell.exe process to execute obfuscated scripts