title: MSHTA Spawning Windows Shell
id: 03cc0c25-389f-4bf8-b48d-11878079f1ca
status: test
description: Detects a Windows command line executable started from MSHTA
author: Michael Haag
references:
  - https://www.trustedsec.com/july-2015/malicious-htas/
date: 2019/01/16
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\mshta.exe'
  selection2:
    - Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\sh.exe'
      - '\bash.exe'
      - '\reg.exe'
      - '\regsvr32.exe'
    - Image|contains:
      - '\BITSADMIN'
  condition: selection and selection2
fields:
  - CommandLine
  - ParentCommandLine
falsepositives:
  - Printer software / driver installations
  - HP software
level: high
tags:
  - attack.defense_evasion
  - attack.t1218.005
  - car.2013-02-003
  - car.2013-03-001
  - car.2014-04-003
