{"id":"cc7abbd0-762b-41e3-8a26-57ad50d2eea3","title":"MSHTA Execution with Suspicious File Extensions","description":"Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content,\nsuch as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications\ncontaining VBScript or JScript. Threat actors often abuse this lolbin utility to download and\nexecute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.\n","author":"Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"high","date":"2019-02-22","modified":"2025-05-12","tags":["attack.stealth","attack.t1140","attack.t1218.005","attack.execution","attack.t1059.007","cve.2020-1599"],"technique_ids":["T1059.007","T1140","T1218.005"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["False positives depend on scripts and administrative tools used in the monitored environment"],"references":["http://blog.sevagas.com/?Hacking-around-HTA-files","https://0x00sec.org/t/clientside-exploitation-in-2018-how-pentesting-has-changed/7356","https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/xml/xslt/xslt-stylesheet-scripting-using-msxsl-script","https://medium.com/tsscyber/pentesting-and-hta-bypassing-powershell-constrained-language-mode-53a42856c997","https://twitter.com/mattifestation/status/1326228491302563846","https://www.virustotal.com/gui/file/c1f27d9795a2eba630db8a043580a0761798f06370fb1317067805f8a845b00c"],"source_path":"rules/windows/process_creation/proc_creation_win_mshta_susp_execution.yml","source_sha256":"67d76c24526db9dadbacb2086115a62b5f6364a39a0d8197de96d6fb738b9774","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_mshta_susp_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: MSHTA Execution with Suspicious File Extensions\nid: cc7abbd0-762b-41e3-8a26-57ad50d2eea3\nstatus: test\ndescription: |\n    Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content,\n    such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications\n    containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and\n    execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.\nreferences:\n    - http://blog.sevagas.com/?Hacking-around-HTA-files\n    - https://0x00sec.org/t/clientside-exploitation-in-2018-how-pentesting-has-changed/7356\n    - https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/xml/xslt/xslt-stylesheet-scripting-using-msxsl-script\n    - https://medium.com/tsscyber/pentesting-and-hta-bypassing-powershell-constrained-language-mode-53a42856c997\n    - https://twitter.com/mattifestation/status/1326228491302563846\n    - https://www.virustotal.com/gui/file/c1f27d9795a2eba630db8a043580a0761798f06370fb1317067805f8a845b00c\nauthor: Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2019-02-22\nmodified: 2025-05-12\ntags:\n    - attack.stealth\n    - attack.t1140\n    - attack.t1218.005\n    - attack.execution\n    - attack.t1059.007\n    - cve.2020-1599\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\mshta.exe'\n        - OriginalFileName: 'mshta.exe'\n    selection_cli:\n        CommandLine|contains:\n            - '.7z'\n            - '.avi'\n            - '.bat'\n            - '.bmp'\n            - '.conf'\n            - '.csv'\n            - '.dll'\n            - '.doc'\n            - '.gif'\n            - '.gz'\n            - '.ini'\n            - '.jpe'\n            - '.jpg'\n            - '.json'\n            - '.lnk'\n            - '.log'\n            - '.mkv'\n            - '.mp3'\n            - '.mp4'\n            - '.pdf'\n            - '.png'\n            - '.ppt'\n            - '.rar'\n            - '.rtf'\n            - '.svg'\n            - '.tar'\n            - '.tmp'\n            - '.txt'\n            - '.xls'\n            - '.xml'\n            - '.yaml'\n            - '.yml'\n            - '.zip'\n            - 'vbscript'\n            # - '.chm'  # could be prone to false positives\n            # - '.exe'\n    condition: all of selection_*\nfalsepositives:\n    - False positives depend on scripts and administrative tools used in the monitored environment\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.007","id":"T1059.007","name":"JavaScript","page":"techniques/enterprise/T1059.007/"},{"key":"enterprise/T1140","id":"T1140","name":"Deobfuscate/Decode Files or Information","page":"techniques/enterprise/T1140/"},{"key":"enterprise/T1218.005","id":"T1218.005","name":"Mshta","page":"techniques/enterprise/T1218.005/"}],"data_path":"data/detection-rules/cc7abbd0-762b-41e3-8a26-57ad50d2eea3.json","kind":"sigma"}