Detection rules › Splunk

Windows Mshta Execution In Registry

Author
Teoderick Contreras, Splunk
Source
upstream

The following analytic detects the execution of mshta.exe via registry entries to run malicious scripts. It leverages registry activity logs to identify entries containing "mshta," "javascript," "vbscript," or "WScript.Shell." This behavior is significant as it indicates potential fileless malware, such as Kovter, which uses encoded scripts in the registry to persist and execute without files. If confirmed malicious, this activity could allow attackers to maintain persistence, execute arbitrary code, and evade traditional file-based detection methods, posing a significant threat to system integrity and security.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1218.005 System Binary Proxy Execution: Mshta

Event coverage

ProviderEvent IDTitle
Sysmon13RegistryEvent (Value Set)

Stages and Predicates

Stage 1: tstats

tstats WHERE (Registry.registry_value_data="*mshta*" OR Registry.registry_value_data IN ("*WScript.Shell*", "*javascript:*", "*vbscript:*")) BY Registry.action, Registry.dest, Registry.process_guid, Registry.process_id, Registry.registry_hive, Registry.registry_path, Registry.registry_key_name, Registry.registry_value_data, Registry.registry_value_name, Registry.registry_value_type, Registry.status, Registry.user, Registry.vendor_product

Stage 2: search

search

Stage 3: search

search

Stage 4: search

search

Stage 5: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Registry.registry_value_dataeq
  • "*mshta*"
Registry.registry_value_datain
  • "*WScript.Shell*"
  • "*javascript:*"
  • "*vbscript:*"