Windows Process Creation: mshtml.dll RunHTMLApplication Execution via Protocol Handlers

title: "Windows Process Creation: mshtml.dll RunHTMLApplication Execution via Protocol Handlers"
id: feef0277-6bed-4889-a1cb-9e0ef79bfeab
related:
  - id: 9f06447a-a33a-4cbe-a94f-a3f43184a7a3
    type: obsolete
  - id: 73fcad2e-ff14-4c38-b11d-4172c8ac86c7
    type: obsolete
  - id: 4782eb5a-a513-4523-a0ac-f3082b26ac5c
    type: derived
status: test
description: This rule flags Windows process creation command lines that include path traversal ("..\"), reference mshtml.dll, and call the RunHTMLApplication export (including "#135" and "RunHTMLApplication"). Such behavior matters because it can be used to execute code through HTML-related functionality and protocol handler chains, blending into normal command-line activity. The detection relies on process_creation telemetry, specifically the command line text containing the mshtml.dll and RunHTMLApplication indicators.
references:
  - https://twitter.com/n1nj4sec/status/1421190238081277959
  - https://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_TROJAN.WIN32.POWESSERE.G_MITIGATION_BYPASS_PART2.txt
  - http://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_DETECTION_BYPASS.txt
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_mshtml_runhtmlapplication.yml
author: Nasreddine Bencherchali (Nextron Systems),  Florian Roth (Nextron Systems), Josh Nickels, frack113, Zaw Min Htun (ZETA), Huntrule Team
date: 2022-08-14
modified: 2024-02-23
tags:
  - attack.execution
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - \..\
      - mshtml
    CommandLine|contains:
      - "#135"
      - RunHTMLApplication
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1