name: Detect MSHTA Url in Command Line
id: 9b3af1e6-5b68-11eb-ae93-0242ac130002
version: 1
date: '2021-01-20'
author: Michael Haag, Splunk
type: batch
datamodel:
- Endpoint
description: This analytic identifies when Microsoft HTML Application Host (mshta.exe)
  utility is used to make remote http connections. Adversaries may use mshta.exe to
  proxy the download and execution of remote .hta files. The analytic identifies command
  line arguments of http and https being used. This technique is commonly used by
  malicious software to bypass preventative controls. The search will return the first
  time and last time these command-line arguments were used for these executions,
  as well as the target system, the user, process "rundll32.exe" and its parent process.
search: '| tstats `security_content_summariesonly` count values(Processes.process)
  as process values(Processes.parent_process) as parent_process min(_time) as firstTime
  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mshta.exe
  (Processes.process="*http://*" OR Processes.process="*https://*") by Processes.user
  Processes.process_name Processes.parent_process_name Processes.dest  | `drop_dm_object_name(Processes)`
  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_mshta_url_in_command_line_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: It is possible legitimate applications may perform this behavior
  and will need to be filtered.
references:
- https://github.com/redcanaryco/AtomicTestHarnesses
- https://redcanary.com/blog/introducing-atomictestharnesses/
- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
tags:
  analytic_story:
  - Suspicious MSHTA Activity
  asset_type: Endpoint
  automated_detection_testing: passed
  cis20:
  - CIS 8
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
  - T1218.005
  nist:
  - PR.PT
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.process
  - Processes.parent_process
  - Processes.process_name
  - Processes.user
  - Processes.dest
  security_domain: endpoint
