PowerShell Script Obfuscation via mshta and vbscript: URL Execution

title: "PowerShell Script Obfuscation via mshta and vbscript: URL Execution"
id: f86282e7-e5ed-432b-9fc5-6117e4001317
status: test
description: This rule flags PowerShell script block content that includes an obfuscation-style sequence using mshta, creating a VBScript COM object, executing with .run, and closing the window. Attackers commonly use mshta to run script content and chain execution to evade simpler detections, making these script block patterns important for visibility. The detection relies on Script Block Logging telemetry capturing the full ScriptBlockText content for matching keywords.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_mhsta.yml
author: Nikita Nazarov, oscd.community, Huntrule Team
date: 2020-10-08
modified: 2022-11-29
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_4104:
    ScriptBlockText|contains|all:
      - set
      - "&&"
      - mshta
      - vbscript:createobject
      - .run
      - (window.close)
  condition: selection_4104
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: e55a5195-4724-480e-a77e-3ebe64bd3759
    type: derived