Windows Process Creation: mshtml.dll RunHTMLApplication Execution via Protocol Handlers
Alerts on Windows command lines invoking mshtml.dll RunHTMLApplication (via #135) with path traversal markers.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems), Josh Nickels, frack113, Zaw Min Htun (ZETA) (SigmaHQ), DRL 1.1
- Published
- 2022-08-14
- Updated
- 2026-07-30
What it detects
This rule flags Windows process creation command lines that include path traversal ("..\"), reference mshtml.dll, and call the RunHTMLApplication export (including "#135" and "RunHTMLApplication"). Such behavior matters because it can be used to execute code through HTML-related functionality and protocol handler chains, blending into normal command-line activity. The detection relies on process_creation telemetry, specifically the command line text containing the mshtml.dll and RunHTMLApplication indicators.
Reporting behind it
- twitter.comhttps://twitter.com/n1nj4sec/status/1421190238081277959
- hyp3rlinx.altervista.orghttps://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_TROJAN.WIN32.POWESSERE.G_MITIGATION_BYPASS_PART2.txt
- hyp3rlinx.altervista.orghttp://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_DETECTION_BYPASS.txt
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_mshtml_runhtmlapplication.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: mshtml.dll RunHTMLApplication Execution via Protocol Handlers"
id: feef0277-6bed-4889-a1cb-9e0ef79bfeab
related:
- id: 9f06447a-a33a-4cbe-a94f-a3f43184a7a3
type: obsolete
- id: 73fcad2e-ff14-4c38-b11d-4172c8ac86c7
type: obsolete
- id: 4782eb5a-a513-4523-a0ac-f3082b26ac5c
type: derived
status: test
description: This rule flags Windows process creation command lines that include path traversal ("..\"), reference mshtml.dll, and call the RunHTMLApplication export (including "#135" and "RunHTMLApplication"). Such behavior matters because it can be used to execute code through HTML-related functionality and protocol handler chains, blending into normal command-line activity. The detection relies on process_creation telemetry, specifically the command line text containing the mshtml.dll and RunHTMLApplication indicators.
references:
- https://twitter.com/n1nj4sec/status/1421190238081277959
- https://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_TROJAN.WIN32.POWESSERE.G_MITIGATION_BYPASS_PART2.txt
- http://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_DETECTION_BYPASS.txt
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_mshtml_runhtmlapplication.yml
author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems), Josh Nickels, frack113, Zaw Min Htun (ZETA), Huntrule Team
date: 2022-08-14
modified: 2024-02-23
tags:
- attack.execution
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains|all:
- \..\
- mshtml
CommandLine|contains:
- "#135"
- RunHTMLApplication
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1