huntrule

Malicious mshta Execution Spawned by PHP-CGI (CVE-2024-4577)

PremiumReviewedSigma · Critical · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-11-04
Updated
2026-11-04
AnalysisDetection

ATT&CK techniques

Initial Access → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects mshta.exe launched as a child of php-cgi.exe. Wiz Research reported the TellYouThePass ransomware exploiting the PHP CGI argument injection flaw to run mshta which loads an HTA that stages VBScript and in-memory .NET, so this parent child chain is a strong indicator of web server exploitation.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange
Suspicious Kubernetes RBAC Binding Granting Access to Anonymous Users
Possible CUPS cups-browsed Remote Code Execution via Shell Child Process
Possible IngressNightmare Exploitation via NGINX Loading Shared Object From Proc (CVE-2025-1974)
Malicious PHASEJAM Webshell Dropped in Ivanti dana-na Auth Directory
Suspicious Modification of CUPS cups-browsed Configuration File
Suspicious OAST Callback DNS Query From Next.js Workload
Suspicious Mshta Spawned From Explorer Command Chain
Malicious Rundll32 RunHTMLApplication Remote Execution
Suspicious Mshta Execution From AppData Directory
Malicious mshta Execution Spawned by PHP-CGI (CVE-2024-4577)
Pivot detection · T1190 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.