Windows Process Creation: Suspicious Child Programs Spawned by mshta, PowerShell, wscript, rundll32

Alerts when mshta/PowerShell and similar script hosts spawn tasks, download/transfer, or utility tools on Windows.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems), Tim Shelton (SigmaHQ), DRL 1.1
Published: 2018-04-06
Updated: 2026-07-30

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
- T1059.005Visual Basic
Persistence
Priv Esc
Defense Evasion
- T1218System Binary Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where a Windows shell or scripting parent process (mshta, PowerShell/pwsh, rundll32, cscript/wscript, wmiprvse, regsvr32) spawns specific child executables often used to stage or execute external functionality (schtasks, nslookup, certutil, bitsadmin, mshta). Such parent-child combinations can indicate execution workflows used for stealth, download/transfer, or proxy execution. The detection relies on process creation telemetry including parent image, child image, and command-line and current-directory context, with exclusions for common environment/script patterns (e.g., SCCM and Amazon WorkSpaces) to reduce false positives.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Windows Process Creation: Suspicious Children Spawned by HTML Help (hh.exe)

Windows: Alert on Suspicious HH.EXE Process Execution

Malicious Script Host Spawning PowerShell With Invoke-Expression (via process_creation)

Suspicious Script Host Spawning PowerShell via BlindEagle Chain

Malicious ClickFix Execution Chain Spawning MSHTA via Pcalua on EtherRAT Infection

Suspicious WScript Spawning PowerShell From VBS Loader via wscript.exe (via process_creation)

Suspicious PowerShell Spawned by Windows Script Host from HTML Smuggling (via process_creation)

Suspicious PowerShell Spawned by Windows Script Host via Process Creation (via process_creation)

Malicious Excel Macro Spawning Scripting Interpreter Downloader (via process_creation)

Windows Process Creation: Suspicious Child Programs Spawned by mshta, PowerShell, wscript, rundll32

Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-suspicious-child-programs-spawned-by-mshta-powershell-w-3a6586ad

title: "Windows Process Creation: Suspicious Child Programs Spawned by mshta, PowerShell, wscript, rundll32"
id: 1ed0e085-5618-4d6c-84b1-bc6df766235c
status: test
description: This rule flags process creation events where a Windows shell or scripting parent process (mshta, PowerShell/pwsh, rundll32, cscript/wscript, wmiprvse, regsvr32) spawns specific child executables often used to stage or execute external functionality (schtasks, nslookup, certutil, bitsadmin, mshta). Such parent-child combinations can indicate execution workflows used for stealth, download/transfer, or proxy execution. The detection relies on process creation telemetry including parent image, child image, and command-line and current-directory context, with exclusions for common environment/script patterns (e.g., SCCM and Amazon WorkSpaces) to reduce false positives.
references:
  - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_shell_spawn_susp_program.yml
author: Florian Roth (Nextron Systems), Tim Shelton, Huntrule Team
date: 2018-04-06
modified: 2023-05-23
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.005
  - attack.t1059.001
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \rundll32.exe
      - \cscript.exe
      - \wscript.exe
      - \wmiprvse.exe
      - \regsvr32.exe
    Image|endswith:
      - \schtasks.exe
      - \nslookup.exe
      - \certutil.exe
      - \bitsadmin.exe
      - \mshta.exe
  filter_ccmcache:
    CurrentDirectory|contains: \ccmcache\
  filter_amazon:
    ParentCommandLine|contains:
      - \Program Files\Amazon\WorkSpacesConfig\Scripts\setup-scheduledtask.ps1
      - \Program Files\Amazon\WorkSpacesConfig\Scripts\set-selfhealing.ps1
      - \Program Files\Amazon\WorkSpacesConfig\Scripts\check-workspacehealth.ps1
      - \nessus_
  filter_nessus:
    CommandLine|contains: \nessus_
  filter_sccm_install:
    ParentImage|endswith: \mshta.exe
    Image|endswith: \mshta.exe
    ParentCommandLine|contains|all:
      - C:\MEM_Configmgr_
      - \splash.hta
      - "{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}"
    CommandLine|contains|all:
      - C:\MEM_Configmgr_
      - \SMSSETUP\BIN\
      - \autorun.hta
      - "{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}"
  condition: selection and not 1 of filter_*
falsepositives:
  - Administrative scripts
  - Microsoft SCCM
level: high
license: DRL-1.1
related:
  - id: 3a6586ad-127a-4d3b-a677-1e6eacdf8fde
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL