Windows: PowerShell-triggered HTA retrieval and execution with registry and process disruption

title: "Windows: PowerShell-triggered HTA retrieval and execution with registry and process disruption"
id: cdc35221-7910-45a8-ad84-05c37d50565c
status: test
description: This rule flags Windows process creation where a PowerShell command line indicates downloading and executing an HTA payload via mshta.exe from an HTTP URL. It also requires additional suspicious command-line components, including registry querying related to Terminal Server Client defaults, uploading a remote file using .NET WebClient, and terminating cmd.exe. Such behavior can align with staged malware delivery and execution, relying on process creation telemetry with full command-line visibility.
references:
  - https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/BabyShark/proc_creation_win_malware_babyshark.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-02-24
modified: 2023-03-08
tags:
  - attack.execution
  - attack.discovery
  - attack.stealth
  - attack.t1012
  - attack.t1059.003
  - attack.t1059.001
  - attack.t1218.005
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - CommandLine|contains|all:
        - powershell.exe mshta.exe http
        - .hta
    - CommandLine|contains:
        - reg query "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default"
        - cmd.exe /c taskkill /im cmd.exe
        - (New-Object System.Net.WebClient).UploadFile('http
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 2b30fa36-3a18-402f-a22d-bf4ce2189f35
    type: derived