Suspicious Mshta.EXE Execution Patterns

Severity: high
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Source: upstream

Detects suspicious mshta process execution patterns

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1106` Native API

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `all of selection_img`

or:
Image|endswith: '\mshta.exe'
OriginalFileName: MSHTA.EXE

Stage 2: `all of selection_susp`

or:
CommandLine|contains: 'C:\ProgramData\'
CommandLine|contains: 'C:\Users\Public\'
CommandLine|contains: 'C:\Windows\Temp\'
CommandLine|contains: '\AppData\Local\'
or:
ParentImage|endswith: '\cmd.exe'
ParentImage|endswith: '\cscript.exe'
ParentImage|endswith: '\powershell.exe'
ParentImage|endswith: '\pwsh.exe'
ParentImage|endswith: '\regsvr32.exe'
ParentImage|endswith: '\rundll32.exe'
ParentImage|endswith: '\wscript.exe'

Stage 3: `selection_img`

or:
Image|endswith: '\mshta.exe'
OriginalFileName: MSHTA.EXE

Stage 4: `not filter_img`

or:
CommandLine|endswith: mshta
CommandLine|endswith: mshta.exe
CommandLine|contains: .hta
CommandLine|contains: .htm
Image|startswith: 'C:\Windows\SysWOW64\'
Image|startswith: 'C:\Windows\System32\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	ends_with	`mshta` `mshta.exe`
`CommandLine`	match	`.hta` corpus 5 (sigma 5) `.htm` `C:\ProgramData\` corpus 6 (sigma 6) `C:\Users\Public\` `C:\Windows\Temp\` corpus 4 (sigma 4) `\AppData\Local\` corpus 8 (sigma 8)
`Image`	ends_with	`\mshta.exe` corpus 57 (sigma 57)
`Image`	starts_with	`C:\Windows\SysWOW64\` corpus 16 (sigma 16) `C:\Windows\System32\` corpus 16 (sigma 16)
`OriginalFileName`	eq	`MSHTA.EXE` corpus 7 (sigma 7)
`ParentImage`	ends_with	`\cmd.exe` corpus 13 (sigma 13) `\cscript.exe` corpus 14 (sigma 14) `\powershell.exe` corpus 16 (sigma 16) `\pwsh.exe` corpus 16 (sigma 16) `\regsvr32.exe` corpus 11 (sigma 11) `\rundll32.exe` corpus 12 (sigma 12) `\wscript.exe` corpus 14 (sigma 14)

Suspicious Mshta.EXE Execution Patterns

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: all of selection_img

Stage 2: all of selection_susp

Stage 3: selection_img

Stage 4: not filter_img

Indicators

Stage 1: `all of selection_img`

Stage 2: `all of selection_susp`

Stage 3: `selection_img`

Stage 4: `not filter_img`