T1218.005 Mshta
Sub-technique of T1218 System Binary Proxy Execution
Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code (Citation: Cylance Dust Storm) (Citation: Red Canary HTA Abuse Part Deux) (Citation: FireEye Attacks Leveraging HTA) (Citation:…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Csc.EXE Execution Form Potentially Suspicious Parenthightest · windows
- HackTool - CACTUSTORCH Remote Thread Creationhightest · windows
- MSHTA Execution with Suspicious File Extensionshightest · windows
- Potential Baby Shark Malware Activityhightest · windows
- Potential LethalHTA Technique Executionhightest · windows
- Remotely Hosted HTA File Executed Via Mshta.EXEhightest · windows
- Suspicious JavaScript Execution Via Mshta.EXEhightest · windows
- Suspicious MSHTA Child Processhightest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.