title: MSHTA Suspicious Execution 01
id: cc7abbd0-762b-41e3-8a26-57ad50d2eea3
status: test
description: Detection for mshta.exe suspicious execution patterns sometimes involving file polyglotism
author: Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule)
references:
  - http://blog.sevagas.com/?Hacking-around-HTA-files
  - https://0x00sec.org/t/clientside-exploitation-in-2018-how-pentesting-has-changed/7356
  - https://docs.microsoft.com/en-us/dotnet/standard/data/xml/xslt-stylesheet-scripting-using-msxsl-script
  - https://medium.com/tsscyber/pentesting-and-hta-bypassing-powershell-constrained-language-mode-53a42856c997
  - https://twitter.com/mattifestation/status/1326228491302563846
date: 2019/02/22
modified: 2021/12/01
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    Image|endswith: '\mshta.exe'
    CommandLine|contains:
      - 'vbscript'
      - '.jpg'
      - '.png'
      - '.lnk'
            # - '.chm'  # could be prone to false positives
      - '.xls'
      - '.doc'
      - '.zip'
      - '.dll'
      - '.exe'
  condition: selection1
falsepositives:
  - False positives depend on scripts and administrative tools used in the monitored environment
level: high
tags:
  - attack.defense_evasion
  - attack.t1140
  - attack.t1218.005
  - attack.execution
  - attack.t1059.007
  - cve.2020.1599
