All Detections

RustyWater Payload Execution

avatar
Elgonad .@elgonad
updated Jan 15, 2026111122

Detects the execution of the RustyWater implant payload "CertificationKit.ini" from the "C:\ProgramData" directory. This activity is associated with the MuddyWater APT group.

Sigma