huntrule

Suspicious PowerShell Copy-Item Into ProgramData Logs by MuddyWater (via process_creation)

PremiumReviewedSigma · Medium · v1
Category
process_creation
Author
HuntRule
Published
2026-09-26
Updated
2026-09-26
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects PowerShell using Copy-Item to stage files into the C:\ProgramData\Logs directory, a technique MuddyWater uses to place malware components in a shared writable location. The unusual staging path combined with scripted copying points to malware setup rather than routine administration. Detecting it exposes early MuddyWater tooling deployment.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious Hidden PowerShell Download Cradle Used by DragonForce Ransomware (via process_creation)
Suspicious PowerShell Download Cradle via Invoke-WebRequest Piped to iex (via process_creation)
Suspicious PowerShell Reverse-HTTP Shellcode Download via CVE-2024-4577 Exploitation
Suspicious Obfuscated Hidden PowerShell with Encoded Command
Suspicious Hidden PowerShell Launched by Batch Script
Suspicious PowerShell String Concatenation Obfuscation for Batch Extension via LNK (via process_creation)
Suspicious AutoIt Interpreter Launched by Script Host or Shell
Suspicious PowerShell Spawned by WScript With Hidden Bypass via PureLogs Loader (via process_creation)
Suspicious PowerShell Execution of TrainedDataStore Script
Suspicious PowerShell Copy-Item Into ProgramData Logs by MuddyWater (via process_creation)
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.