Potential MuddyWater APT Activity via MSHTA and PowerShell

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•3•0•46

Detects potential MuddyWater APT activity involving the use of mshta for execution, PowerShell for system information discovery (operating system, network configuration, security center), and a PowerShell-based backdoor with base64 encoding and web requests.