Skip to content
Threat Feed

Actor

MuddyWater

1 brief RSS
high threat

MuddyWater PowGoop Beacon Decoding Detection

This detection identifies a DLL decoding and executing the PowGoop config.txt payload, indicating a stage in the MuddyWater infection chain where an obfuscated PowerShell beacon is unwrapped and live C2 communication starts.

Splunk Enterprise +3 MuddyWater powgoop dll-sideloading powershell c2 beacon
2r 4t