Potential MuddyWater APT Activity

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects potential Muddywater APT activity

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Execution	No specific technique
Stealth	No specific technique

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Potential MuddyWater APT Activity
id: 36222790-0d43-4fe8-86e4-674b27809543
status: test
description: Detects potential Muddywater APT activity
references:
    - https://www.mandiant.com/resources/blog/iranian-threat-group-updates-ttps-in-spear-phishing-campaign
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-03-10
tags:
    - attack.execution
    - attack.stealth
    - attack.g0069
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_mshta:
        CommandLine|contains|all:
            - 'vbscript:Close(Execute("CreateObject('
            - 'powershell'
            - '-w 1 -exec Bypass'
            - '\ProgramData\'
    selection_survey:
        CommandLine|contains|all:
            - 'Win32_OperatingSystem'
            - 'Win32_NetworkAdapterConfiguration'
            - 'root\SecurityCenter2'
            - '[System.Net.DNS]'
    selection_pwsh_backdoor:
        CommandLine|contains|all:
            - '[Convert]::ToBase64String'
            - '[System.Text.Encoding]::UTF8.GetString]'
            - 'GetResponse().GetResponseStream()'
            - '[System.Net.HttpWebRequest]::Create('
            - '-bxor '
    condition: 1 of selection_*
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

1 of selection_*

Stage 1: `selection_mshta`

selection_mshta:
    CommandLine|contains|all:
        - 'vbscript:Close(Execute("CreateObject('
        - 'powershell'
        - '-w 1 -exec Bypass'
        - '\ProgramData\'

Stage 2: `selection_survey`

selection_survey:
    CommandLine|contains|all:
        - 'Win32_OperatingSystem'
        - 'Win32_NetworkAdapterConfiguration'
        - 'root\SecurityCenter2'
        - '[System.Net.DNS]'

Stage 3: `selection_pwsh_backdoor`

selection_pwsh_backdoor:
    CommandLine|contains|all:
        - '[Convert]::ToBase64String'
        - '[System.Text.Encoding]::UTF8.GetString]'
        - 'GetResponse().GetResponseStream()'
        - '[System.Net.HttpWebRequest]::Create('
        - '-bxor '

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-bxor` `-w 1 -exec Bypass` `GetResponse().GetResponseStream()` `Win32_NetworkAdapterConfiguration` `Win32_OperatingSystem` `[Convert]::ToBase64String` corpus 2 (sigma 1, elastic 1) `[System.Net.DNS]` `[System.Net.HttpWebRequest]::Create(` `[System.Text.Encoding]::UTF8.GetString]` `\ProgramData\` corpus 4 (sigma 3, elastic 1) `powershell` corpus 25 (sigma 24, chronicle 1) `root\SecurityCenter2` `vbscript:Close(Execute("CreateObject(`	`field:"CommandLine" kind:match`

Potential MuddyWater APT Activity

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_mshta

Stage 2: selection_survey

Stage 3: selection_pwsh_backdoor

Indicators

Stage 0: `condition`

Stage 1: `selection_mshta`

Stage 2: `selection_survey`

Stage 3: `selection_pwsh_backdoor`