Potential MuddyWater APT Activity

{
  "process_creation": {
    "EventID": 4688,
    "Channel": "Security"
  },
  "selection_mshta": {
    "CommandLine
| contains
| all": [
      "vbscript:Close(Execute(\"CreateObject(",
      "powershell",
      "-w 1 -exec Bypass",
      "\\ProgramData\\"
    ]
  },
  "selection_survey": {
    "CommandLine
| contains
| all": [
      "Win32_OperatingSystem",
      "Win32_NetworkAdapterConfiguration",
      "root\\SecurityCenter2",
      "[System.Net.DNS]"
    ]
  },
  "selection_pwsh_backdoor": {
    "CommandLine
| contains
| all": [
      "[Convert]::ToBase64String",
      "[System.Text.Encoding]::UTF8.GetString]",
      "GetResponse().GetResponseStream()",
      "[System.Net.HttpWebRequest]::Create(",
      "-bxor "
    ]
  },
  "condition": "process_creation and (1 of selection_*)"
}

False Positives

• ⚠ Unlikely