Detects BRICKSTORM backdoor used by APT group UNC5221 (China Nexus)

Hunt Hypothesis

This hunt hypothesis targets the deployment of the BRICKSTORM backdoor by the China Nexus APT group to identify early-stage persistence mechanisms that may evade standard signature-based detection. Proactively hunting for this behavior in Azure Sentinel is critical because UNC5221’s sophisticated use of custom backdoors often indicates a strategic foothold establishment preceding advanced data exfiltration or lateral movement campaigns.

YARA Rule

rule MAL_G_Backdoor_BRICKSTORM_2 {
   meta:
      description = "Detects BRICKSTORM backdoor used by APT group UNC5221 (China Nexus)"
      author = "Google Threat Intelligence Group (GTIG) (modified by Florian Roth)"
      date = "2025-09-25"
      score = 75
      reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
      id = "03618840-c3f3-5ba6-983b-181a855d506b"
   strings:
      // $obf_func = /[a-z]{20}\/[a-z]{20}\/[a-z]{20}\/[a-z]{20}.go/
      $decr1 = { 0F B6 4C 04 ?? 0F B6 54 04 ?? 31 D1 88 4C 04 ?? 48 FF C0 [0-4] 48 83 F8 ?? 7C }
      $decr2 = { 40 88 7C 34 34 48 FF C3 48 FF C6 48 39 D6 7D 18 0F B6 3B 48 39 CE 73 63 44 0F B6 04 30 44 31 C7 48 83 FE 04 72 DA }
      $decr3 = { 0F B6 54 0C ?? 0F B6 5C 0C ?? 31 DA 88 14 08 48 FF C1 48 83 F9 ?? 7C E8 }

      $str1 = "main.selfWatcher"
      $str2 = "main.copyFile"
      $str3 = "main.startNew"

      $str4 = "WRITE_LOG=true"
      $str5 = "WRITE_LOGWednesday"
      $str6 = "vami-httpdvideo/webm"
      $str7 = "/opt/vmware/sbin/"
      $str8 = "/home/vsphere-ui/"
      $str9 = "/opt/vmware/sbin/vami-http"
      $str10 = "main.getVFromEnv"
   condition:
      uint32(0) == 0x464c457f
      and filesize < 10MB
      and (
         1 of ($decr*)
         and 1 of ($str*)
         or 5 of ($str*)
      )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 14 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the BRICKSTORM backdoor detection rule, tailored for an enterprise environment:

Scenario: Automated Patch Deployment via SCCM
- Context: The System Center Configuration Manager (SCCM) deploys a Windows Update package to endpoints. During installation, the wuauserv service or the ccmsetup.exe process spawns child processes that execute PowerShell scripts with network connectivity similar to BRICKSTORM’s initial communication pattern.
- Filter/Exclusion: Exclude processes where the parent executable is ccmsetup.exe, ccmexec.exe, or wuauserv.exe. Additionally, filter out events originating from the specific SCCM site server IP range (e.g., 10.20.5.0/24).
Scenario: Scheduled PowerShell Health Checks
- Context: A nightly scheduled task runs a custom PowerShell script (HealthCheck.ps1) to query internal monitoring databases and send telemetry data. The script utilizes Invoke-WebRequest with specific headers that mimic the beaconing behavior of the BRICKSTORM backdoor, triggering the detection logic on outbound HTTPS connections.
- Filter/Exclusion: Create an exclusion for scheduled tasks named “Daily Health Check” or “Telemetry Sync.” Filter events where the command line contains HealthCheck.ps1 and the destination domain is a known internal monitoring domain (e.g., monitor.internal.corp).
Scenario: Microsoft Defender Cloud App Security Scans
- Context: The Microsoft Defender for Endpoint agent performs periodic cloud-based threat intelligence synchronization. This process establishes persistent connections to Microsoft’s update servers using specific User-Agent strings and port 443, which can overlap with the network signature of UNC5221’s backdoor communication.
- Filter/Exclusion: Exclude