RemoteUtilities - S0592 (03c6e0ea-96d3-4b23-9afb-05055663cf4b)

RemoteUtilities is a legitimate remote administration tool that has been used by MuddyWater since at least 2021 for execution on target machines.(Citation: Trend Micro Muddy Water March 2021)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
RemoteUtilities - S0592 (03c6e0ea-96d3-4b23-9afb-05055663cf4b)	mitre-tool	Screen Capture - T1113 (0259baeb-9f63-4c69-bf10-eb038c390688)	Attack Pattern	1
RemoteUtilities - S0592 (03c6e0ea-96d3-4b23-9afb-05055663cf4b)	mitre-tool	Ingress Tool Transfer - T1105 (e6919abc-99f9-4c6c-95a5-14761e7b2add)	Attack Pattern	1
RemoteUtilities - S0592 (03c6e0ea-96d3-4b23-9afb-05055663cf4b)	mitre-tool	File and Directory Discovery - T1083 (7bc57495-ea59-4380-be31-a64af124ef18)	Attack Pattern	1
RemoteUtilities - S0592 (03c6e0ea-96d3-4b23-9afb-05055663cf4b)	mitre-tool	Msiexec - T1218.007 (365be77f-fc0e-42ee-bac8-4faf806d9336)	Attack Pattern	1
Msiexec - T1218.007 (365be77f-fc0e-42ee-bac8-4faf806d9336)	Attack Pattern	System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4)	Attack Pattern	2