Iran Multi-Actor Cyber Campaign Following Military Operation

Type	Value	Context	Confidence
FILE_PATH	C:\Windows\Temp\*.exe	Iranian threat actors frequently drop payloads and tools in Windows Temp directory for staging, particularly when executed by suspicious parent processes (cmd.exe, powershell.exe, or Office applications) or when filenames match known malware families; legitimate software rarely executes unsigned binaries from Temp with obfuscated names, so look for process creation events with Temp-sourced executables lacking proper code signatures, unusual parent-child process chains, and execution patterns occurring outside normal software installation windows.	medium
FILE_PATH	C:\ProgramData\*.dll	Suspicious .dll files in C:\ProgramData\ are indicative of post-exploitation persistence when they are unsigned, lack legitimate vendor provenance, or are spawned by non-system processes (cmd.exe, powershell.exe, rundll32.exe); legitimate software rarely uses unsigned DLLs in this shared directory, and EDR should flag unsigned binaries in ProgramData combined with execution from rundll32 or registry run key references as high-confidence indicators of MuddyWater and APT33 loader deployment.	medium
FILE_PATH	C:\Users\Public\*.ps1	PowerShell scripts dropped in public directories used for lateral movement and execution by Iranian actors	medium
REGISTRY_KEY	HKCU\Software\Microsoft\Windows\CurrentVersion\Run\*	Persistence mechanism used by Iranian APT groups including MuddyWater and APT35 for maintaining access	high
REGISTRY_KEY	HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*	Used by Iranian actors for persistence and defense evasion via debugger hijacking	medium
REGISTRY_KEY	HKCU\Software\Microsoft\Office\*\Excel\Security\AccessVBOM	Modified to enable macro execution, associated with Iranian spearphishing campaigns using malicious Office documents	medium
URL	https://*/upload.php	Common C2 exfiltration endpoint pattern observed in Iranian-linked webshell and RAT campaigns	medium
URL	https://*/panel/index.php	C2 panel URL pattern associated with Iranian threat actor infrastructure	medium
FILE_PATH	C:\Windows\System32\Tasks\*	Scheduled tasks created by Iranian APT groups for persistence, often mimicking legitimate Windows task names	high
FILE_PATH	%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.lnk	LNK file persistence mechanism used by MuddyWater and related Iranian threat clusters	medium
FILE_PATH	C:\Windows\SysWOW64\*.dat	Encoded payload storage location used by Iranian actors to evade detection	medium
FILE_PATH	\\\ADMIN$\.exe	SMB-based lateral movement path used during Iranian military-targeted intrusion campaigns	medium
FILE_PATH	C:\Windows\System32\wbem\mofcomp.exe	WMI-based persistence technique abused by Iranian actors for fileless persistence via MOF files; suspicious when mofcomp.exe is spawned by Office macros, scripts (powershell.exe, cscript.exe, wscript.exe), or from temp/download directories rather than legitimate WMI compilation tasks, and differs from legitimate use where mofcomp.exe is rarely invoked directly by end-user processes or scheduled tasks without administrator oversight. Hunt for mofcomp.exe process execution with parent processes excluding wmiprvse.exe or svchost.exe, command-line arguments referencing .mof files in user-writable paths, and correlate with WMI Event Consumer creation events in Windows Event Log (Event ID 5861).	medium
FILE_PATH	%TEMP%\~*.tmp	Temporary file staging pattern associated with Iranian dropper and loader activity	medium