Sigma rule: Potential MuddyWater APT Activity

Rule

Title

Potential MuddyWater APT Activity

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2023-03-10

File

rules-emerging-threats/2018/TA/MuddyWater/proc_creation_win_apt_muddywater_activity.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potential Muddywater APT activity

Log source

product

windows

category

process_creation

Detection

selection_mshta:
    CommandLine|contains|all:
        - 'vbscript:Close(Execute("CreateObject('
        - 'powershell'
        - '-w 1 -exec Bypass'
        - '\ProgramData\'
selection_survey:
    CommandLine|contains|all:
        - 'Win32_OperatingSystem'
        - 'Win32_NetworkAdapterConfiguration'
        - 'root\SecurityCenter2'
        - '[System.Net.DNS]'
selection_pwsh_backdoor:
    CommandLine|contains|all:
        - '[Convert]::ToBase64String'
        - '[System.Text.Encoding]::UTF8.GetString]'
        - 'GetResponse().GetResponseStream()'
        - '[System.Net.HttpWebRequest]::Create('
        - '-bxor '
condition: 1 of selection_*

False positives (as the rule lists them)

• Unlikely

Tags

• attack.execution
• attack.stealth
• attack.g0069
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• G0069

References

• https://www.mandiant.com/resources/blog/iranian-threat-group-updates-ttps-in-spear-phishing-campaign

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2018/TA/MuddyWater/proc_creation_win_apt_muddywater_activity.yml