Skip to content
Threat Feed

Tag

Beacon

2 briefs RSS
high threat

MuddyWater PowGoop Beacon Decoding Detection

This detection identifies a DLL decoding and executing the PowGoop config.txt payload, indicating a stage in the MuddyWater infection chain where an obfuscated PowerShell beacon is unwrapped and live C2 communication starts.

Splunk Enterprise +3 MuddyWater powgoop dll-sideloading powershell c2 beacon
2r 4t
high advisory

Detection of Default Cobalt Strike PowerShell Beacon

This brief outlines detection strategies for default Cobalt Strike PowerShell beacons, which are used for command and control, by identifying specific function and variable names within PowerShell script block logs.

Splunk Enterprise +2 cobaltstrike powershell beacon commandandcontrol windows
2r 2t