T1218.005 Mshta
Subtécnica de T1218 System Binary Proxy Execution
Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code (Citation: Cylance Dust Storm) (Citation: Red Canary HTA Abuse Part Deux) (Citation: FireEye Attacks Leveraging HTA) (Citation:…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- Csc.EXE Execution Form Potentially Suspicious Parenthightest · windows
- HackTool - CACTUSTORCH Remote Thread Creationhightest · windows
- MSHTA Execution with Suspicious File Extensionshightest · windows
- Potential Baby Shark Malware Activityhightest · windows
- Potential LethalHTA Technique Executionhightest · windows
- Remotely Hosted HTA File Executed Via Mshta.EXEhightest · windows
- Suspicious JavaScript Execution Via Mshta.EXEhightest · windows
- Suspicious MSHTA Child Processhightest · windows
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.