MuddyWater — Iranian MOIS Espionage APT

Looks for: RMM agents MuddyWater abuses, on endpoints outside the sanctioned support fleet. Accomplishes: the highest-value foothold signal. FP: sanctioned RMM — allow-list its deploy + IT host group.

// HUNT: MuddyWater RMM abuse (RMM agent on a non-IT host)
// MITRE: T1219 | CONF: high  FP: medium  COST: low
// TUNING: allow-list any sanctioned RMM + the IT-support host group
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(atera|AteraAgent|ScreenConnect|Connectwisecontrol|SimpleHelp|remote_access|Windows-?Agent|BASupSrvc|syncro|N-?able|takecontrol)[^\\]*\.exe$/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName], limit=200)

Looks for: a binary from a user-writable path spawning powershell.exe with download/exec or hidden-window flags. Accomplishes: the MuddyC2Go loader→PowerShell-C2 pattern. FP: some installers — verify the path + command.

// HUNT: MuddyC2Go loader spawning an embedded PowerShell C2 agent
// MITRE: T1059.001, T1027 | CONF: high  FP: low-med  COST: low
// TUNING: exclude sanctioned installers; focus on user-path parents + hidden/iex commands
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^powershell\.exe$/i
| ParentImageFileName=/\\(ProgramData|Users\\[^\\]+\\AppData|Temp)\\.+\.exe$/i
| CommandLine=/(-w\s+hidden|-windowstyle\s+hidden|-nop|-ep\s+bypass|iex|FromBase64String|DownloadString|Invoke-WebRequest)/i
| table([@timestamp, ComputerName, UserName, ParentImageFileName, CommandLine], limit=200)

Looks for: powershell.exe making repeated outbound connections to an external host. Accomplishes: POWERSTATS/MuddyC2Go agent C2. FP: admin scripts — scope to external, correlate with Q2/4104.

// HUNT: PowerShell C2 beacon (POWERSTATS / MuddyC2Go agent)
// MITRE: T1059.001, T1071.001 | CONF: medium  FP: medium  COST: medium
// TUNING: exclude internal/admin endpoints; correlate to Q2 + EID 4104
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^powershell\.exe$/i
| RemoteAddressIP4!=/^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.|127\.)/
| table([@timestamp, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], limit=200)

Looks for: a freshly-written executable in a user path that beacons, consistent with the RustyWater implant. Accomplishes: catches the 2026 implant. FP: correlate write→exec→network; verify with vendor hashes when available.

// HUNT: RustyWater implant (user-path exe write -> exec -> beacon)
// MITRE: T1105, T1071.001 | CONF: medium  FP: low-med  COST: low
// TUNING: add vendor RustyWater hashes/paths as published; correlate to Q1/Q2 on same aid
#event_simpleName=/NewExecutableWritten|PeFileWritten/
| TargetFileName=/\\(ProgramData|Users\\[^\\]+\\AppData|Temp)\\.+\.(exe|dll)$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName, SHA256HashData], limit=200)

Looks for: Office/archive apps spawning script hosts / installers (MuddyWater lure chain). FP: some legit macros/installers — correlate with a following RMM/C2 hit.

// HUNT: MuddyWater spearphishing execution lineage
// MITRE: T1566.001, T1204.002 | CONF: medium  FP: medium  COST: low
// TUNING: correlate to a following Q1/Q2 hit; exclude sanctioned macro/installer flows
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(winword|excel|powerpnt|outlook|WinRAR|Rar|7zFM)\.exe$/i
| FileName=/^(powershell|pwsh|mshta|wscript|cscript|cmd|msiexec)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

Looks for: a burst of built-in discovery commands on a host with a recent RMM/C2 hit. Accomplishes: the espionage recon stage. FP: admin scripts — correlate with Q1/Q2/Q3.

// HUNT: MuddyWater LOLBin reconnaissance
// MITRE: T1087, T1082, T1018 | CONF: medium  FP: medium  COST: low
// TUNING: scope to hosts with a recent Q1/Q2/Q3 hit; allow-list admin AIDs
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(whoami|nltest|net|net1|systeminfo|ipconfig|tasklist|quser|qwinsta|arp|route|netstat|dsquery)\.exe$/i
| groupBy([aid, ComputerName, UserName], function=[count(), collect([FileName, CommandLine], limit=20)])
| _count >= 5
| sort(_count, order=desc)