From cbcccc8d44dc7723cca4a3a0bffe663db07a8f0c Mon Sep 17 00:00:00 2001
From: timfrazier1 <timfrazier1@users.noreply.github.com>
Date: Mon, 11 Jun 2018 14:10:31 -0400
Subject: [PATCH] Creating new example scriptlet

---
 atomics/T1170/mshta.sct | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 atomics/T1170/mshta.sct

diff --git a/atomics/T1170/mshta.sct b/atomics/T1170/mshta.sct
new file mode 100644
index 00000000..4b021400
--- /dev/null
+++ b/atomics/T1170/mshta.sct
@@ -0,0 +1,23 @@
+<?XML version="1.0"?>
+<scriptlet>
+<registration 
+    progid="PoC"
+    classid="{F0001111-0000-0000-0000-0000FEEDACDC}" >
+	<!-- mshta.sct example file -->
+
+	<!-- .sct files when downloaded, are executed from a path like this -->
+	<!-- Please Note, file extenstion does not matter -->
+	<!-- Though, the name and extension are arbitary.. -->
+	<!-- c:\users\USER\appdata\local\microsoft\windows\temporary internet files\content.ie5\2vcqsj3k\file[2].sct -->
+	<!-- Based on current research, no registry keys are written, since call "uninstall" -->
+  	<!-- You can either execute locally, or from a url -->
+	<script language="JScript">
+		<![CDATA[
+	    		// calc.exe should launch, this could be any arbitrary code.
+      	   		// What you are hoping to catch is the cmdline, modloads, or network connections, or any variation
+			var r = new ActiveXObject("WScript.Shell").Run("notepad.exe");	
+	
+		]]>
+</script>
+</registration>
+</scriptlet>