Windows Mshta.exe Launching JavaScript via Command Line

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1218.005Mshta
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where Mshta.exe is executed with a command line containing the term "javascript". Attackers commonly use Mshta as a proxy execution method to run script content without spawning a typical scripting host, which can help evade simpler detections. It relies on Windows process creation telemetry, matching the executable path/name and searching the process command line for the JavaScript keyword.

Reporting behind it

Related detections9 linkedT1218.005 — drag to rearrange

Suspicious MSHTA Execution Spawned by Browser or Document Reader via Mispadu (via process_creation)

Suspicious Office Application Spawning Mshta With Remote HTA

Suspicious MSHTA VBScript WScript Shell Execution

Suspicious Remote HTA Payload Execution via MSHTA

Malicious Shell Spawned by Mshta Delivery (via process_creation)

Malicious Kimsuky Remote HTA Execution via URL Shortener (via process_creation)

ClickFix Paste-Jacking Execution of mshta Retrieving Remote Payload (via process_creation)

Suspicious mshta Execution of Remote HTA Payload

Suspicious Mshta Executed From Non-System Path (via process_creation)

Windows Mshta.exe Launching JavaScript via Command Line

Pivot detection · T1218.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-mshta-exe-launching-javascript-via-command-line-67f113fa

title: Windows Mshta.exe Launching JavaScript via Command Line
id: bdbc43b4-9fdb-4f52-a1a5-cb843b9156f0
status: test
description: This rule flags process creation events where Mshta.exe is executed with a command line containing the term "javascript". Attackers commonly use Mshta as a proxy execution method to run script content without spawning a typical scripting host, which can help evade simpler detections. It relies on Windows process creation telemetry, matching the executable path/name and searching the process command line for the JavaScript keyword.
references:
  - https://eqllib.readthedocs.io/en/latest/analytics/6bc283c4-21f2-4aed-a05c-a9a3ffa95dd4.html
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.005/T1218.005.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mshta_javascript.yml
author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Huntrule Team
date: 2019-10-24
modified: 2023-02-07
tags:
  - attack.stealth
  - attack.t1218.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \mshta.exe
    - OriginalFileName: MSHTA.EXE
  selection_cli:
    CommandLine|contains: javascript
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 67f113fa-e23d-4271-befa-30113b3e08b1
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL