MuddyWater — Microsoft Teams External Message Followed by Process Spawn

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•5

Detects Microsoft Teams spawning child processes (cmd, powershell, wscript, mshta, rundll32, regsvr32, certutil) after receiving external communications, a technique used by MuddyWater for initial access and execution.