1200KM / detection
T1218.005 Mshta — Detection Rules
Detection workspace for T1218.005 Mshta: 7 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- HackTool - CACTUSTORCH Remote Thread Creation · test · high · {"product":"windows","category":"create_remote_thread"}
- Csc.EXE Execution Form Potentially Suspicious Parent · test · high · {"category":"process_creation","product":"windows"}
- Remotely Hosted HTA File Executed Via Mshta.EXE · test · high · {"category":"process_creation","product":"windows"}
- Suspicious JavaScript Execution Via Mshta.EXE · test · high · {"category":"process_creation","product":"windows"}
- Potential LethalHTA Technique Execution · test · high · {"category":"process_creation","product":"windows"}
- Suspicious MSHTA Child Process · test · high · {"category":"process_creation","product":"windows"}
- MSHTA Execution with Suspicious File Extensions · test · high · {"category":"process_creation","product":"windows"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0506 Detecting Mshta-based Proxy Execution via Suspicious HTA or Script Invocation
AN1397 Analytic 1397
Detection of mshta.exe execution where command-line arguments reference remote or local HTA/script content (VBScript/JScript) followed by subsequent file creation, network retrieval, or process spawning that indicates payload execution outside standard Internet Explorer security context. Correlation includes parent process lineage, command-line inspection, and network connection creation to untrusted or anomalous endpoints.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.