Potential MuddyWater APT Activity

Rule Info

Tags
attack.defense_evasion attack.g0069 attack.execution DEMO
Modified
None
Author
Nasreddine Bencherchali (Nextron Systems)
Name
Potential MuddyWater APT Activity
Description
Detects potential Muddywater APT activity
Date
2023-03-10 00:00:00
Reference
https://www.mandiant.com/resources/blog/iranian-threat-group-updates-ttps-in-spear-phishing-campaign
Id
36222790-0d43-4fe8-86e4-674b27809543
Type
Community Rule
Link to Public Repo
https://github.com/SigmaHQ/sigma/search?q=36222790-0d43-4fe8-86e4-674b27809543

Rule History

Commit
Date
Author
Title
d7083f617
2023-03-13
Nasreddine Bencherchali
fix: apply suggestions from code review
a8462ec91
2023-03-10
Nasreddine Bencherchali
feat: more apt rules updates
THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022