Windows PowerShell/MSHTA Command-Line Indicators of Baby Shark Malware Activity

title: Windows PowerShell/MSHTA Command-Line Indicators of Baby Shark Malware Activity
id: cdc35221-7910-45a8-ad84-05c37d50565c
status: test
description: This rule flags process executions where a PowerShell command line includes an mshta-based HTTP download and references an .hta payload. It also looks for follow-on behavior consistent with environment discovery or disruption, including a registry query under the current user profile and a command to kill cmd.exe. The detection relies on Windows process creation telemetry with command-line fields to identify these correlated indicators in a single process command line.
references:
  - https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/BabyShark/proc_creation_win_malware_babyshark.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-02-24
modified: 2023-03-08
tags:
  - attack.execution
  - attack.discovery
  - attack.stealth
  - attack.t1012
  - attack.t1059.003
  - attack.t1059.001
  - attack.t1218.005
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - CommandLine|contains|all:
        - powershell.exe mshta.exe http
        - .hta
    - CommandLine|contains:
        - reg query "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default"
        - cmd.exe /c taskkill /im cmd.exe
        - (New-Object System.Net.WebClient).UploadFile('http
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 2b30fa36-3a18-402f-a22d-bf4ce2189f35
    type: derived