Detects backdoor BRICKSTEAL used by APT group UNC5221 (China Nexus)

Hunt Hypothesis

This hunt targets the deployment of the BRICKSTEAL backdoor by the China Nexus APT group to identify potential long-term persistence and data exfiltration activities within our Azure Sentinel environment. Proactive hunting for this specific adversary behavior is critical due to its high severity, enabling early detection of sophisticated supply chain compromises that could otherwise remain undetected until significant data loss occurs.

YARA Rule

rule MAL_G_Backdoor_BRICKSTEAL_1 {
   meta:
      description = "Detects backdoor BRICKSTEAL used by APT group UNC5221 (China Nexus)"
      author = "Google Threat Intelligence Group (GTIG) (modified by Florian Roth)"
      date = "2025-09-25"
      score = 75
      reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
      id = "2457d600-d9dd-504f-baa3-699ec5c61eae"
   strings:
      $str1 = "comvmware"
      $str2 = "abcdABCD1234!@#$"
      $str3 = "ads.png"
      $str4 = "User-Agent"
      $str5 = "com/vmware/"
   condition:
      all of them and filesize < 10KB
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the BRICKSTEAL backdoor detection rule, tailored for an enterprise environment:

• Scenario: Automated Backup Agent Scans

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik often utilize a service account (e.g., svc_backup) that performs deep file system scans and moves large data blocks to storage repositories. The BRICKSTEAL signature may flag the high-volume I/O operations, specific registry key modifications for configuration, and network connections to backup targets as suspicious backdoor behavior.
  • Filter/Exclusion: Create an exclusion rule based on the Process Name (VeeamService.exe or rubrik-agent) combined with the User Account (svc_backup). Additionally, exclude traffic destined for known internal IP ranges of the backup infrastructure (e.g., 10.20.50.x/24).

• Scenario: Scheduled Microsoft Defender Antivirus Updates

  • Context: The Microsoft Defender Antivirus service runs scheduled tasks during off-hours to download definition updates and perform real-time protection scans. These tasks often involve creating temporary files, modifying registry keys under HKLM\SOFTWARE\Policies, and establishing outbound connections to update servers. This behavior mimics the file staging and network communication patterns of BRICKSTEAL.
  • Filter/Exclusion: Exclude events where the Process Command Line contains keywords like “UpdateService” or “ScanEngine,” and filter out traffic originating from the Microsoft Update Service process (MpCmdG.exe) connecting to Microsoft’s CDN IP ranges (e.g., 13.107.x.x).

• Scenario: Configuration Management Tool Execution (Ansible/Chef)

  • Context: DevOps teams utilize tools like Ansible or **