PowerShell Module: Obfuscated Script Invocation Using MSHTA

Alerts when PowerShell module payload text includes an obfuscated MSHTA/VBScript invocation sequence.

FreeUnreviewedSigmahighv1

powershell-module-obfuscated-script-invocation-using-mshta-07ad2ea8

title: "PowerShell Module: Obfuscated Script Invocation Using MSHTA"
id: 58e26d27-033f-420b-abc8-a04342f0c6fc
related:
  - id: e55a5195-4724-480e-a77e-3ebe64bd3759
    type: derived
  - id: 07ad2ea8-6a55-4ac6-bf3e-91b8e59676eb
    type: derived
status: test
description: This rule flags PowerShell module telemetry where the script payload contains a specific sequence used to invoke MSHTA for VBS scripting (including vbscript:createobject and execution via .run, followed by window.close). Attackers commonly use this pattern to hide execution intent and run script-based content through a trusted Windows binary. Detection relies on the payload text field containing all required substrings that match this obfuscated invocation pattern.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_mhsta.yml
author: Nikita Nazarov, oscd.community, Huntrule Team
date: 2020-10-08
modified: 2023-01-04
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection:
    Payload|contains|all:
      - set
      - "&&"
      - mshta
      - vbscript:createobject
      - .run
      - (window.close)
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags PowerShell module telemetry where the script payload contains a specific sequence used to invoke MSHTA for VBS scripting (including vbscript:createobject and execution via .run, followed by window.close). Attackers commonly use this pattern to hide execution intent and run script-based content through a trusted Windows binary. Detection relies on the payload text field containing all required substrings that match this obfuscated invocation pattern.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.