Detects backdoor BRICKSTEAL dropper used by APT group UNC5221 (China Nexus)

Hunt Hypothesis

This hunt hypothesis targets the initial deployment of the BRICKSTEAL backdoor dropper by the China Nexus APT group to identify early-stage compromise and data exfiltration capabilities within our Azure Sentinel environment. Proactively hunting for this specific adversary behavior is critical because UNC5221’s sophisticated use of legitimate tools allows them to evade standard signature-based defenses, necessitating a behavioral approach to detect stealthy persistence mechanisms before significant impact occurs.

YARA Rule

rule MAL_G_Dropper_BRICKSTEAL_1 {
   meta:
      description = "Detects backdoor BRICKSTEAL dropper used by APT group UNC5221 (China Nexus)"
      author = "Google Threat Intelligence Group (GTIG) (modified by Florian Roth)"
      date = "2025-09-25"
      score = 75
      reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
      id = "c96eeeb0-ccb4-572c-80b5-638ce3bb51a9"
   strings:
      $str1 = "Base64.getDecoder().decode"
      $str2 = "Thread.currentThread().getContextClassLoader()"
      $str3 = ".class.getDeclaredMethod"
      $str4 = "byte[].class"
      $str5 = "method.invoke"
      $str6 = "filterClass.newInstance()"
      $str7 = "/websso/SAML2/SSO/*"
   condition:
      all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

References

• https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the BRICKSTEAL dropper detection rule, including suggested filters and exclusions:

• Legitimate Software Deployment via SCCM/Intune

  • Scenario: Enterprise Configuration Management tools (e.g., Microsoft Endpoint Configuration Manager or Intune) deploy a new application package that includes a PowerShell script or installer executable. If the deployment agent executes a dropper-like process to unpack and install the payload, it mimics the behavior of the BRICKSTEAL dropper.
  • Filter/Exclusion: Exclude processes where the parent process is ccmexec.exe (SCCM) or Microsoft.IntuneManagementAgent.exe, specifically when the file hash matches a known good deployment package in the asset inventory.

• Scheduled Maintenance and Patching Jobs

  • Scenario: A nightly scheduled task runs a PowerShell script to apply security patches or update antivirus definitions. The script often invokes a temporary dropper executable to distribute updates across endpoints, triggering the rule due to the “dropping” of new files into system directories (e.g., C:\Windows\Temp or ProgramData).
  • Filter/Exclusion: Create an exclusion for processes spawned by the Windows Task Scheduler (svchost.exe with service name Schedule) where the command line contains specific keywords like /patch, /update, or references to known internal script paths (e.g., \\fileserver\scripts\maintenance.ps1).

• Third-Party Backup and Archive Solutions

  • Scenario: Enterprise backup agents (such as Veeam, Commvault, or Acronis) perform incremental backups by creating temporary staging files. The agent may use a dropper mechanism to stage data before compression, which can be misidentified as the BRICKSTEAL dropper activity due to similar file creation patterns in system directories.