Windows mshta.exe launched with URL-based arguments (http/https/ftp)

title: Windows mshta.exe launched with URL-based arguments (http/https/ftp)
id: 9fb0c7c7-9fe7-4b4d-98d8-2f01df89a30a
status: test
description: This rule flags process creation where the executable is mshta (mshta.exe / OriginalFileName MSHTA.EXE) and its command line includes an external URL scheme such as http://, https://, or ftp://. Attackers commonly use mshta to load and execute content from a remotely hosted HTA, enabling stealthy execution via a signed Windows binary. The detection relies on Windows process creation telemetry including the process image name and full command line.
references:
  - https://www.trendmicro.com/en_us/research/22/e/avoslocker-ransomware-variant-abuses-driver-file-to-disable-anti-Virus-scans-log4shell.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mshta_http.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-08
modified: 2023-02-06
tags:
  - attack.execution
  - attack.stealth
  - attack.t1218.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \mshta.exe
    - OriginalFileName: MSHTA.EXE
  selection_cli:
    CommandLine|contains:
      - http://
      - https://
      - ftp://
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: b98d0db6-511d-45de-ad02-e82a98729620
    type: derived