Detects BRICKSTORM backdoor used by APT group UNC5221 (China Nexus)

Hunt Hypothesis

This hunt hypothesis targets the deployment of the BRICKSTORM backdoor by the Chinese APT group UNC5221 to identify early-stage persistence mechanisms that may evade standard signature-based detection. Proactive hunting in Azure Sentinel is critical because this high-severity threat often establishes covert command-and-control channels that require behavioral analysis to uncover before adversaries can exfiltrate sensitive data or move laterally across the network.

YARA Rule

rule MAL_G_APT_Backdoor_BRICKSTORM_3 {
   meta:
      description = "Detects BRICKSTORM backdoor used by APT group UNC5221 (China Nexus)"
      author = "Google Threat Intelligence Group (GTIG) (modified by Florian Roth)"
      date = "2025-09-25"
      score = 75
      reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
      md5 = "931eacd7e5250d29903924c31f41b7e5"
      id = "d50d60ec-0238-569e-911a-696b994416f9"
   strings:
      $str1 = { 48 8B 05 ?? ?? ?? ?? 48 89 04 24 E8 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 04 24 [0-5] E8 ?? ?? ?? ?? EB ?? }
      $str4 = "decompress" ascii  // wide nocase
      $str5 = "MIMEHeader" ascii  // wide nocase
      $str6 = "ResolveReference" ascii  // wide nocase
      $str7 = "115792089210356248762697446949407573529996955224135760342422259061068512044369115792089210356248762697446949407573530086143415290314195533631308867097853951" ascii  // wide nocase
   condition:
      uint16(0) == 0x457F and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign
• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the BRICKSTORM backdoor detection rule, tailored to an enterprise environment:

• Scenario: Legitimate execution of Microsoft Defender for Endpoint (or similar EDR) self-updates or policy synchronization tasks.

  • Context: The BRICKSTORM backdoor often mimics legitimate system processes. In many environments, the MsMpEng.exe process (Microsoft Antimalware) spawns child processes to update signatures or sync policies that match the specific file hash or command-line structure of the BRICKSTORM indicator.
  • Suggested Filter/Exclusion: Exclude alerts where the parent process is MsMpEng.exe, SenseBrokerService.exe (CrowdStrike), or osqueryd.exe. Additionally, create a whitelist for the specific file path: C:\Program Files\Microsoft Defender Antivirus\bin\MsMpEng.exe.

• Scenario: Scheduled PowerShell jobs running automated compliance or inventory scripts.

  • Context: UNC5221’s BRICKSTORM often utilizes PowerShell for persistence and command execution. Enterprise IT teams frequently use scheduled tasks (Task Scheduler) to run powershell.exe with arguments that invoke remote management modules (e.g., Invoke-Command, Get-CimInstance) which can trigger the same detection logic regarding network connections or process creation patterns used by the backdoor.
  • Suggested Filter/Exclusion: Exclude alerts where the command line contains specific enterprise keywords such as -ExecutionPolicy Bypass combined with known internal script paths (e.g., \\fileserver\scripts\compliance_check.ps1). Alternatively, filter out events originating from trusted Service Accounts (e.g., DOMAIN\svc-inventory) running scheduled tasks defined in the “System” context.

• Scenario: Deployment of third-party backup or monitoring agents (e.g.,