mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Patrick Bareiss
32 lines
1.6 KiB
YAML
32 lines
1.6 KiB
YAML
name: Suspicious MSHTA Activity
|
|
id: 2b1800dd-92f9-47dd-a981-fdf13w1q5d55
|
|
version: 1
|
|
date: '2020-02-03'
|
|
description: Monitor and detect techniques used by attackers who leverage the mshta.exe
|
|
process to execute malicious code.
|
|
narrative: 'One common adversary tactic is to bypass application white-listing solutions
|
|
via the mshta.exe process, which executes Microsoft HTML applications with the .hta
|
|
suffix. In these cases, attackers use the trusted Windows utility to eproxy execution
|
|
of malicious files, whether an .hta application, javascript, or VBScript.\
|
|
|
|
One example of a notable mshta.exe attack was the Kovter malware (https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5)
|
|
that was implicated in ransomware and click-fraud attacks. Kovter utilized .hta
|
|
to execute a series of javascript commands, each progressively more dangerous. According
|
|
to the Mitre Parternship Network (https://attack.mitre.org/wiki/Technique/T1170),
|
|
FIN7 has leveraged mshta.exe, as has the MuddyWater group, who used it to execute
|
|
its POWERSTATS payload (which then used the utility to execute additional payloads).\
|
|
|
|
The searches in this story help you detect and investigate suspicious activity that
|
|
may indicate that an attacker is leveraging mshta.exe to execute malicious code.'
|
|
author: Bhavin Patel, Splunk
|
|
type: ESCU
|
|
references:
|
|
- https://redcanary.com/blog/windows-registry-attacks-threat-detection/
|
|
- https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5
|
|
- https://attack.mitre.org/wiki/Technique/T1170
|
|
tags:
|
|
analytics_story: Suspicious MSHTA Activity
|
|
usecase: Advanced Threat Detection
|
|
category:
|
|
- Adversary Tactics
|