Detects backdoor BRICKSTEAL dropper used by APT group UNC5221 (China Nexus)

Hunt Hypothesis

This hunt hypothesis targets the initial deployment of the BRICKSTEAL backdoor dropper employed by the China Nexus APT group to establish persistent access within Azure environments. Proactively hunting for this behavior is critical because early detection of the dropper allows the SOC team to identify and contain the threat before it executes its full payload, thereby preventing potential data exfiltration or lateral movement.

YARA Rule

rule MAL_G_Dropper_BRICKSTEAL_2 {
   meta:
      description = "Detects backdoor BRICKSTEAL dropper used by APT group UNC5221 (China Nexus)"
      author = "Google Threat Intelligence Group (GTIG) (modified by Florian Roth)"
      date = "2025-09-25"
      score = 75
      reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
      id = "8139f8c0-4c18-51bd-bf23-8c4cdc3fd555"
   strings:
      // $str1 = /\(Class<\?>\)\smethod\.invoke\(\w{1,20},\s\w{1,20},\s0,\s\w{1,20}\.length\);/i ascii wide
      $str1_alt = "(Class<?>) method.invoke(" ascii wide
      $str2 = "(\"yv66vg" ascii wide
      $str3 = "request.getSession().getServletContext" ascii wide
      $str4 = ".getClass().getDeclaredField(" ascii wide
      $str5 = "new FilterDef();" ascii wide
      $str6 = "new FilterMap();" ascii wide
   condition:
      all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

References

• https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign
• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the BRICKSTEAL dropper detection rule, tailored for an enterprise environment:

• Scenario: Scheduled Software Deployment via SCCM/Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune agents frequently deploy new software packages to endpoints during maintenance windows. These deployments often involve dropping executable installers into the C:\Windows\Temp directory before execution, mimicking the “dropper” behavior of BRICKSTEAL which stages payloads in temporary locations.
  • Filter/Exclusion: Exclude processes originating from known deployment services (e.g., ccmsetup.exe, Microsoft.IntuneManagementAgent) where the parent process is a trusted management service account (e.g., NT SERVICE\CCM). Additionally, filter out events where the dropped file’s hash matches a known good baseline in the enterprise software library.

• Scenario: Automated Antivirus Definition Updates

  • Context: Endpoint protection suites like CrowdStrike Falcon or Symantec Endpoint Protection perform daily definition updates. The update engine often extracts compressed archives containing new signature databases and drops them into specific system directories (e.g., C:\ProgramData\Microsoft\Windows Defender) before the main service loads them, triggering a “dropper” alert due to the creation of new executables or DLLs in protected paths.
  • Filter/Exclusion: Create an exclusion for file creation events where the parent process is the specific AV engine (e.g., csagent.exe, rtvscan64.exe) and the destination path matches the vendor’s standard update directory structure.

• Scenario: PowerShell Script Execution by Admins

  • Context: IT administrators frequently run PowerShell scripts to patch systems or configure group policies. A common pattern involves a script (powershell.exe) invoking New-Item