Windows mshta.exe Process Creation Triggered by Suspicious Command Lines

title: Windows mshta.exe Process Creation Triggered by Suspicious Command Lines
id: cec22bdb-6acc-4540-8254-7f72350ed333
status: test
description: This rule flags suspicious process creation events where mshta.exe is executed, either by matching the mshta executable image/name or by specific command-line context. It focuses on risky parent processes (such as cmd.exe, PowerShell, wscript/cscript, regsvr32, and rundll32) combined with locations and arguments commonly used to stage script-based payloads. The detection relies on Windows process creation telemetry, including Image, OriginalFileName, ParentImage, and CommandLine.
references:
  - https://en.wikipedia.org/wiki/HTML_Application
  - https://www.echotrail.io/insights/search/mshta.exe
  - https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mshta_susp_pattern.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-07-17
modified: 2023-02-21
tags:
  - attack.execution
  - attack.t1106
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \mshta.exe
    - OriginalFileName: MSHTA.EXE
  selection_susp:
    ParentImage|endswith:
      - \cmd.exe
      - \cscript.exe
      - \powershell.exe
      - \pwsh.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \wscript.exe
    CommandLine|contains:
      - \AppData\Local\
      - C:\ProgramData\
      - C:\Users\Public\
      - C:\Windows\Temp\
  filter_img:
    - Image|startswith:
        - C:\Windows\System32\
        - C:\Windows\SysWOW64\
    - CommandLine|contains:
        - .htm
        - .hta
    - CommandLine|endswith:
        - mshta.exe
        - mshta
  condition: all of selection_* or (selection_img and not filter_img)
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: e32f92d1-523e-49c3-9374-bdb13b46a3ba
    type: derived