SIGNATURE_BASE_MAL_G_Dropper_BRICKSTEAL_1

rule SIGNATURE_BASE_MAL_G_Dropper_BRICKSTEAL_1
{
	meta:
		description = "Detects backdoor BRICKSTEAL dropper used by APT group UNC5221 (China Nexus)"
		author = "Google Threat Intelligence Group (GTIG) (modified by Florian Roth)"
		id = "c96eeeb0-ccb4-572c-80b5-638ce3bb51a9"
		date = "2025-09-25"
		modified = "2026-05-15"
		reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_brickstorm_sep25.yar#L155-L173"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "5ed68f17ba8ac0c7ba02f9111f083244181332c71ed43b4cd5582baee493c98d"
		score = 75
		quality = 85
		tags = ""

	strings:
		$str1 = "Base64.getDecoder().decode"
		$str2 = "Thread.currentThread().getContextClassLoader()"
		$str3 = ".class.getDeclaredMethod"
		$str4 = "byte[].class"
		$str5 = "method.invoke"
		$str6 = "filterClass.newInstance()"
		$str7 = "/websso/SAML2/SSO/*"

	condition:
		all of them
}