MuddyWater has exploited the Microsoft Netlogon vulnerability (CVE-2020-1472).(Citation: DHS CISA AA22-055A MuddyWater February 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

MuddyWater has stored a decoy PDF file within a victim's

MuddyWater has used JavaScript files to execute its

POWERSTATS payload.(Citation: ClearSky MuddyWater Nov 2018)(Citation: FireEye MuddyWater Mar 2018)(Citation: DHS CISA AA22-055A MuddyWater February 2022)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|

MuddyWater can disable the system's local proxy settings.(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1219|Remote Access Software|

MuddyWater has used a legitimate application, ScreenConnect, to manage systems remotely and move laterally.(Citation: Trend Micro Muddy Water March 2021)(Citation: Anomali Static Kitten February 2021) |
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518|Software Discovery|

MuddyWater has used a PowerShell backdoor to check for Skype connectivity on the target machine.(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

MuddyWater has used a PowerShell backdoor to check for Skype connections on the target machine.(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1059.006|Python|

MuddyWater has used developed tools in Python including

Out1.(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.002|Domain Account|