rules/windows/process_creation/proc_creation_win_lethalhta.yml

title: MSHTA Spwaned by SVCHOST
id: ed5d72a6-f8f4-479d-ba79-02f6a80d7471
status: test
description: Detects MSHTA.EXE spwaned by SVCHOST as seen in LethalHTA and described in report
author: Markus Neis
references:
  - https://codewhitesec.blogspot.com/2018/07/lethalhta.html
date: 2018/06/07
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\svchost.exe'
    Image|endswith: '\mshta.exe'
  condition: selection
falsepositives:
  - Unknown
level: high
tags:
  - attack.defense_evasion
  - attack.t1218.005
fix: fixed casing and long rule titles 2020-01-30 17:26:09 +01:00			`title: MSHTA Spwaned by SVCHOST`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: ed5d72a6-f8f4-479d-ba79-02f6a80d7471`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`status: test`
fix: fixed casing and long rule titles 2020-01-30 17:26:09 +01:00			`description: Detects MSHTA.EXE spwaned by SVCHOST as seen in LethalHTA and described in report`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`author: Markus Neis`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`references:`
			`- https://codewhitesec.blogspot.com/2018/07/lethalhta.html`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`date: 2018/06/07`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`modified: 2021/11/27`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`logsource:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`category: process_creation`
			`product: windows`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`detection:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`selection:`
			`ParentImage\|endswith: '\svchost.exe'`
			`Image\|endswith: '\mshta.exe'`
			`condition: selection`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`falsepositives:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- Unknown`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`level: high`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`tags:`
			`- attack.defense_evasion`
			`- attack.t1218.005`