MuddyWater Node.js Spawning PowerShell

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•15

Detects node.exe spawning PowerShell, a technique used by the MuddyWater (also known as Seedworm) threat group for post-exploitation reconnaissance, staging, and screenshot capture. This rule specifically looks for the 'node.exe' process initiating 'powershell.exe' or 'pwsh.exe'.