Detects webshell used by APT group UNC5221 (China Nexus)

Hunt Hypothesis

This hunt hypothesis targets the deployment of persistent webshells by the China Nexus APT group to identify early-stage command-and-control channels that may evade standard signature-based detections. Proactively hunting for this behavior in Azure Sentinel is critical because UNC5221 frequently leverages compromised web servers as a foothold for lateral movement, allowing the SOC team to intercept potential data exfiltration before it escalates into a broader breach.

YARA Rule

rule WEBSHELL_G_APT_BackdoorWebshell_SLAYSTYLE_1 {
   meta:
      description = "Detects webshell used by APT group UNC5221 (China Nexus)"
      author = "Google Threat Intelligence Group (GTIG) (modified by Florian Roth)"
      date = "2025-09-25"
      score = 75
      reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
      id = "6d3dfb91-a14b-5420-b17b-c6d65c94fc53"
   strings:
      //$str1 = /String \w{1,10}=request\.getParameter\(\"\w{1,15}\"\);/ ascii wide nocase
      $str1_alt = "=request.getParameter(\""
      $str2 = "=new String(java.util.Base64.getDecoder().decode(" ascii wide nocase
      //$str21 = /String\[\]\s\w{1,10}=\{\"\/bin\/sh\",\"-c\",\w{1,10}\+\"\s2>&1\"\};/ ascii wide nocase
      $str21_alt = "={\"/bin/sh\",\"-c\"," ascii
      $str3 = "= Runtime.getRuntime().exec(" ascii
      $str4 = "java.io.InputStream" ascii
      $str5 = "java.util.Base64.getEncoder().encodeToString(org.apache.commons.io.IOUtils.toByteArray(" ascii
   condition:
      filesize < 5MB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

References

• https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects webshell used by APT group UNC5221 (China Nexus) rule, including targeted filters and exclusions:

• Scenario: Automated Backup Scripts Executing via IIS

  • Context: Enterprise backup solutions like Veeam or Rubrik often deploy scheduled PowerShell scripts that run within the IIS w3wp worker process context. These scripts frequently write temporary configuration files to web directories (e.g., C:\inetpub\wwwroot) and execute them, mimicking the file creation and execution behavior of a UNC5221 webshell.
  • Filter/Exclusion: Exclude alerts where the parent process is vssvc.exe or rubrik-agent.exe, and the script path contains known backup directories (e.g., *Veeam\BackupJobs*). Additionally, filter out events where the file extension is .ps1 rather than the typical .aspx or .php often used by UNC5221 webshells.

• Scenario: Legitimate Admin Maintenance via Remote Desktop

  • Context: System administrators frequently log in via Remote Desktop Services (RDS) to perform routine maintenance on web servers. During these sessions, admins may manually upload and execute diagnostic tools or configuration updates directly into the web root using tools like WinSCP or PowerShell ISE. This activity generates file creation and process execution events that overlap with APT webshell signatures.
  • Filter/Exclusion: Apply a filter to exclude alerts originating from user accounts prefixed with ADM_ or SVC_ (e.g., ADM_JSmith) during standard business hours (08:00–18:00). Furthermore, exclude events where the source IP is within the internal corporate subnet range (e.g.,