title: TA505 Dropper Load Pattern
id: 18cf6cf0-39b0-4c22-9593-e244bdc9a2d4
status: test
description: Detects mshta loaded by wmiprvse as parent as used by TA505 malicious documents
author: Florian Roth
references:
  - https://twitter.com/ForensicITGuy/status/1334734244120309760
date: 2020/12/08
modified: 2022/01/07
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\mshta.exe'
    ParentImage|endswith: '\wmiprvse.exe'
  condition: selection
falsepositives:
  - Unknown
level: critical
tags:
  - attack.execution
  - attack.g0092
  - attack.t1106
