MuddyWater: CertificationKit.ini Staging Or Execution Activity

Georg Lauenstein@gsec

•updated Jan 31, 2026•17•13•328

Detects creation and/or attempted execution of C:\ProgramData\CertificationKit.ini, a staging path observed in MuddyWater VBA dropper activity. This rule correlates file creation with suspicious execution attempts (cmd.exe referencing the INI path) on the same host within a short window to increase fidelity.