Detects BRICKSTORM backdoor used by APT group UNC5221 (China Nexus)

Hunt Hypothesis

This hunt hypothesis targets the presence of the BRICKSTORM backdoor deployed by the China Nexus (UNC5221) APT group to identify early-stage persistence and command-and-control activities within Azure Sentinel. Proactively hunting for this specific threat is critical due to its high severity classification, enabling the SOC team to detect sophisticated Chinese state-sponsored intrusions before they establish deeper footholds in the enterprise environment.

YARA Rule

rule MAL_G_APT_Backdoor_BRICKSTORM_2 {
   meta:
      description = "Detects BRICKSTORM backdoor used by APT group UNC5221 (China Nexus)"
      author = "Google Threat Intelligence Group (GTIG) (modified by Florian Roth)"
      date = "2025-09-25"
      score = 75
      reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
      id = "8418b887-9183-5364-a9d8-d2d4dbdefe83"
   strings:
      $str1 = { 0F 57 C0 0F 11 84 ?? ?? ?? ?? ?? C6 44 ?? ?? 00 4? C7 84 ?? ?? ?? ?? ?? 00 00 00 00 0F 57 C0 0F 11 84 ?? ?? ?? ?? ?? 0F 11 84 ?? ?? ?? ?? ?? 4? 8B 84 ?? ?? ?? ?? ?? 4? 89 04 ?? 4? 8B 8C ?? ?? ?? ?? ?? 4? 89 4C ?? ?? E8 ?? ?? ?? ?? 4? 83 7C ?? ?? 00 0F 84 ?? ?? ?? ?? 4? 8D 05 ?? ?? ?? ?? 4? 89 ?? ?? E8 ?? ?? ?? ?? 4? 8B 7C ?? ?? 4? 8B 84 ?? ?? ?? ?? ?? 4? 89 47 08 83 3D ?? ?? ?? ?? 00 75 ?? 4? 8B 84 ?? ?? ?? ?? ?? 4? 89 07 4? 89 BC ?? ?? ?? ?? ?? 4? C7 84 ?? ?? ?? ?? ?? 01 00 00 00 4? C7 84 ?? ?? ?? ?? ?? 01 00 00 00 0F 57 C0 0F 11 84 ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? ?? 4? 81 C4 ?? ?? ?? ?? C3 }
      $str2 = { 4? C7 84 ?? ?? ?? ?? ?? 00 00 00 00 4? C7 84 ?? ?? ?? ?? ?? 00 00 00 00 4? C7 84 ?? ?? ?? ?? ?? 00 00 00 00 4? C7 84 ?? ?? ?? ?? ?? 00 00 00 00 4? C7 84 ?? ?? ?? ?? ?? 00 00 00 00 4? 8B 84 ?? ?? ?? ?? ?? 4? 89 04 ?? 4? 8B 8C ?? ?? ?? ?? ?? 4? 89 4C ?? ?? E8 ?? ?? ?? ?? 4? 8B 44 ?? ?? 4? 85 C0 0F 84 ?? ?? ?? ?? 4? 8D 05 ?? ?? ?? ?? 4? 89 ?? ?? E8 ?? ?? ?? ?? 4? 8B 44 ?? ?? 4? 8B 8C ?? ?? ?? ?? ?? 4? 89 48 08 8B 0D ?? ?? ?? ?? 85 C9 75 ?? 4? 8B 8C ?? ?? ?? ?? ?? 4? 89 08 84 00 4? 89 84 ?? ?? ?? ?? ?? 4? C7 84 ?? ?? ?? ?? ?? 01 00 00 00 4? C7 84 ?? ?? ?? ?? ?? 01 00 00 00 4? C7 84 ?? ?? ?? ?? ?? 00 00 00 00 4? C7 84 ?? ?? ?? ?? ?? 00 00 00 00 90 E8 ?? ?? ?? ?? 4? 8B ?? ?4 D8 00 00 00 4? 81 C4 E0 00 00 00 C3 }
   condition:
      uint32be(0) == 0x7F454C46 and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the BRICKSTORM backdoor detection rule, tailored to an enterprise environment:

• Scenario: Scheduled PowerShell Script Execution by IT Operations

  • Context: The “IT Ops” service account runs a nightly maintenance script (C:\Scripts\DailyHealthCheck.ps1) via Task Scheduler. This script utilizes Start-Process to launch multiple child processes with specific command-line arguments that mimic the BRICKSTORM execution pattern (e.g., invoking powershell.exe -WindowStyle Hidden).
  • Suggested Filter: Create an exclusion based on the Parent Process Name (Task Scheduler Host or svchost.exe) and the File Path of the script. Exclude alerts where the parent process is taskscheduler.exe (PID 1024) AND the executed file path matches C:\Scripts\DailyHealthCheck.ps1.

• Scenario: Endpoint Protection Agent Self-Updates

  • Context: The enterprise uses Microsoft Defender for Endpoint or CrowdStrike Falcon. During off-hours, the agent performs a self-update routine that spawns a temporary worker process to download and install definitions. This process often executes with elevated privileges and command-line parameters resembling the BRICKSTORM backdoor’s persistence mechanism.
  • Suggested Filter: Exclude alerts where the Executable Name is MsMpEng.exe (Defender) or FalconSensor.exe (CrowdStrike) AND the User Account belongs to the local system account (NT AUTHORITY\SYSTEM) or a dedicated service account like svc-endpoint-protection.

• Scenario: Deployment of Configuration Management Tools

  • Context: The DevOps team utilizes Ansible or Chef agents running on workstations. When applying configuration drifts, these tools execute remote commands via PowerShell or CMD to