Detects webshell used by APT group UNC5221 (China Nexus)

Hunt Hypothesis

This detection rule identifies the deployment of a malicious webshell associated with the China Nexus (UNC5221) APT group to monitor for initial access and persistent command execution within web-facing applications. Proactive hunting in Azure Sentinel is critical because UNC5221 frequently targets government and defense sectors, where early identification of this specific webshell can prevent lateral movement and data exfiltration before the adversary establishes a deeper foothold.

YARA Rule

rule WEBSHELL_G_APT_BackdoorWebshell_SLAYSTYLE_2 {
   meta:
      description = "Detects webshell used by APT group UNC5221 (China Nexus)"
      author = "Google Threat Intelligence Group (GTIG) (modified by Florian Roth)"
      date = "2025-09-25"
      score = 75
      reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
      id = "5ab6791b-5043-5fa1-b73e-caba9e059eaa"
   strings:
      $str1 = "request.getParameter"
      $str2 = "/bin/sh"
      $str3 = "java.io.InputStream"
      $str4 = "Runtime.getRuntime().exec("
      $str5 = "2>&1"
   condition:
      (uint16(0) != 0x5A4D and uint32(0) != 0x464C457F) and filesize < 7KB and all of them and @str4 > @str2
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects webshell used by APT group UNC5221 (China Nexus) rule, along with suggested filters or exclusions tailored for a legitimate enterprise environment:

• Scenario: Automated Backup and Maintenance Scripts

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik often deploy lightweight management agents that create temporary .aspx or .php files in the web root (IIS or Apache) to facilitate status reporting and remote configuration. These scripts may contain logic resembling UNC5221’s known obfuscation techniques (e.g., base64 encoded command execution blocks).
  • Suggested Filter/Exclusion: Exclude traffic originating from specific backup service accounts (e.g., DOMAIN\VeeamService) or filter out files created within the standard backup maintenance window (e.g., 02:00–04:00 UTC) in known backup directories (C:\ProgramData\Veeam\BackupWeb).

• Scenario: DevOps CI/CD Pipeline Artifact Deployment

  • Context: Continuous Integration tools such as Jenkins, GitLab Runner, or Azure DevOps Agents frequently deploy temporary web artifacts to staging environments. During the deployment phase, these agents often write diagnostic .jsp or .html files that include embedded JavaScript for health checks, which can mimic the “webshell” signature of UNC5221 due to similar file extensions and HTTP request patterns.
  • Suggested Filter/Exclusion: Create an exclusion rule based on source IP ranges belonging to the CI/CD cluster (e.g., 10.20.30.0/24) and filter events where the user agent string contains specific keywords like “Jenkins”, “GitLab-Runner”, or “AzureDevOps