WEBSHELL_G_APT_BackdoorWebshell_SLAYSTYLE_1

rule WEBSHELL_G_APT_BackdoorWebshell_SLAYSTYLE_1 {
   meta:
      description = "Detects webshell used by APT group UNC5221 (China Nexus)"
      author = "Google Threat Intelligence Group (GTIG) (modified by Florian Roth)"
      date = "2025-09-25"
      score = 75
      reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
      id = "6d3dfb91-a14b-5420-b17b-c6d65c94fc53"
   strings:
      //$str1 = /String \w{1,10}=request\.getParameter\(\"\w{1,15}\"\);/ ascii wide nocase
      $str1_alt = "=request.getParameter(\""
      $str2 = "=new String(java.util.Base64.getDecoder().decode(" ascii wide nocase
      //$str21 = /String\[\]\s\w{1,10}=\{\"\/bin\/sh\",\"-c\",\w{1,10}\+\"\s2>&1\"\};/ ascii wide nocase
      $str21_alt = "={\"/bin/sh\",\"-c\"," ascii
      $str3 = "= Runtime.getRuntime().exec(" ascii
      $str4 = "java.io.InputStream" ascii
      $str5 = "java.util.Base64.getEncoder().encodeToString(org.apache.commons.io.IOUtils.toByteArray(" ascii
   condition:
      filesize < 5MB and all of them
}