• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    MuddyWater Misspelled Service Registration

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Ibrahim Saud@tektrix
    •updated Jun 17, 2026•0•0•2

    Detects references to the misspelled service 'MicrosoftUpdateSerice' during service creation or manipulation within process command lines. This specific misspelling has been associated with the MuddyWater APT group.

    Microsoft Sentinel (KQL)

    Tags

    G0069 - MuddyWaterT1543.003 - Windows ServiceT1569.002 - Service ExecutionTA0003 - PersistenceTA0004 - Privilege EscalationTA0002 - ExecutionProcess EventCommand ExecutionService CreatedService StartedWindowsWindows Defender Atpkql

    Found in

    • Analysis of Muddywater Moodleuni C2 RATLast updated Jun 11, 2026

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?