Windows Process Creation: Suspicious Child Programs Spawned by mshta, PowerShell, wscript, rundll32

title: "Windows Process Creation: Suspicious Child Programs Spawned by mshta, PowerShell, wscript, rundll32"
id: 1ed0e085-5618-4d6c-84b1-bc6df766235c
status: test
description: This rule flags process creation events where a Windows shell or scripting parent process (mshta, PowerShell/pwsh, rundll32, cscript/wscript, wmiprvse, regsvr32) spawns specific child executables often used to stage or execute external functionality (schtasks, nslookup, certutil, bitsadmin, mshta). Such parent-child combinations can indicate execution workflows used for stealth, download/transfer, or proxy execution. The detection relies on process creation telemetry including parent image, child image, and command-line and current-directory context, with exclusions for common environment/script patterns (e.g., SCCM and Amazon WorkSpaces) to reduce false positives.
references:
  - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_shell_spawn_susp_program.yml
author: Florian Roth (Nextron Systems), Tim Shelton, Huntrule Team
date: 2018-04-06
modified: 2023-05-23
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.005
  - attack.t1059.001
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \rundll32.exe
      - \cscript.exe
      - \wscript.exe
      - \wmiprvse.exe
      - \regsvr32.exe
    Image|endswith:
      - \schtasks.exe
      - \nslookup.exe
      - \certutil.exe
      - \bitsadmin.exe
      - \mshta.exe
  filter_ccmcache:
    CurrentDirectory|contains: \ccmcache\
  filter_amazon:
    ParentCommandLine|contains:
      - \Program Files\Amazon\WorkSpacesConfig\Scripts\setup-scheduledtask.ps1
      - \Program Files\Amazon\WorkSpacesConfig\Scripts\set-selfhealing.ps1
      - \Program Files\Amazon\WorkSpacesConfig\Scripts\check-workspacehealth.ps1
      - \nessus_
  filter_nessus:
    CommandLine|contains: \nessus_
  filter_sccm_install:
    ParentImage|endswith: \mshta.exe
    Image|endswith: \mshta.exe
    ParentCommandLine|contains|all:
      - C:\MEM_Configmgr_
      - \splash.hta
      - "{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}"
    CommandLine|contains|all:
      - C:\MEM_Configmgr_
      - \SMSSETUP\BIN\
      - \autorun.hta
      - "{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}"
  condition: selection and not 1 of filter_*
falsepositives:
  - Administrative scripts
  - Microsoft SCCM
level: high
license: DRL-1.1
related:
  - id: 3a6586ad-127a-4d3b-a677-1e6eacdf8fde
    type: derived