BrickStorm C2 File Metadata Threat-Hunt query

Sam Harrison@sect0rcybersec

•updated Dec 6, 2025•64•1•474

Looks for Metadata IOCs as listed in the CISA report on BrickStorm C2 malware. I don't recommend using this query on its own; rather, use it in conjunction with behavioural analysis to look for evidence of BrickStorm activity. https://media.defense.gov/2025/Dec/04/2003834878/-1/-1/0/MALWARE-ANALYSIS-REPORT-BRICKSTORM-BACKDOOR.PDF