Windows: PowerShell-triggered HTA retrieval and execution with registry and process disruption

Alerts on Windows process creation where PowerShell uses mshta over HTTP and includes .hta, registry query, and cmd.exe termination.

FreeReviewedSigma · High · v5

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2019-02-24
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution → Discovery

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
- T1059.003Windows Command Shell
Persistence
Priv Esc
Defense Evasion
- T1218.005Mshta
Cred Access
Discovery
- T1012Query Registry
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation where a PowerShell command line indicates downloading and executing an HTA payload via mshta.exe from an HTTP URL. It also requires additional suspicious command-line components, including registry querying related to Terminal Server Client defaults, uploading a remote file using .NET WebClient, and terminating cmd.exe. Such behavior can align with staged malware delivery and execution, relying on process creation telemetry with full command-line visibility.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Malicious Forfiles Proxy Execution Launching PowerShell and MSHTA in PEAKLIGHT Chain (via process_creation)

Malicious ClickFix PowerShell Launching mshta with Remote URL (via process_creation)

MSSQL Server Process Spawning Command Shell via xp_cmdshell

Suspicious PowerShell Query of MSHTA Application Class in PEAKLIGHT Chain (via ps_script)

Suspicious MSSQL xp_cmdshell OS Command Execution via sqlservr.exe (via process_creation)

Malicious Fire Ant Host-to-Guest Command Execution via VMware Tools (via process_creation)

Malicious Office Application Spawning a Command Shell or Script Interpreter (via process_creation)

Malicious PowerShell or Command Shell Spawned by SQL Server via xp_cmdshell

Windows AppLocker Audit-Mode Events Indicate Files Would Have Been Blocked

Windows: PowerShell-triggered HTA retrieval and execution with registry and process disruption

Pivot detection · T1059.001 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-mshta-command-line-indicators-of-baby-shark-malware-activity-2b30fa36

title: "Windows: PowerShell-triggered HTA retrieval and execution with registry and process disruption"
id: cdc35221-7910-45a8-ad84-05c37d50565c
status: test
description: This rule flags Windows process creation where a PowerShell command line indicates downloading and executing an HTA payload via mshta.exe from an HTTP URL. It also requires additional suspicious command-line components, including registry querying related to Terminal Server Client defaults, uploading a remote file using .NET WebClient, and terminating cmd.exe. Such behavior can align with staged malware delivery and execution, relying on process creation telemetry with full command-line visibility.
references:
  - https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/BabyShark/proc_creation_win_malware_babyshark.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-02-24
modified: 2023-03-08
tags:
  - attack.execution
  - attack.discovery
  - attack.stealth
  - attack.t1012
  - attack.t1059.003
  - attack.t1059.001
  - attack.t1218.005
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - CommandLine|contains|all:
        - powershell.exe mshta.exe http
        - .hta
    - CommandLine|contains:
        - reg query "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default"
        - cmd.exe /c taskkill /im cmd.exe
        - (New-Object System.Net.WebClient).UploadFile('http
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 2b30fa36-3a18-402f-a22d-bf4ce2189f35
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL