Windows Process Creation: Suspicious Children Spawned by mshta.exe

title: "Windows Process Creation: Suspicious Children Spawned by mshta.exe"
id: d4ee7775-ea66-461a-b32e-40215cc2bf12
status: test
description: This rule identifies process creation events where the parent process is mshta.exe and the child process is one of several common command/script utilities (e.g., cmd.exe, PowerShell, wscript/cscript, bash/sh, reg.exe, regsvr32, bitsadmin). Attackers often abuse mshta.exe to execute malicious HTA content and then leverage these tools to run commands or stage payloads. The detection relies on Windows process creation telemetry, specifically parent image path endswith matching for mshta.exe and child image/original filename endswith or exact name matching.
references:
  - https://www.trustedsec.com/july-2015/malicious-htas/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mshta_susp_child_processes.yml
author: Michael Haag, Huntrule Team
date: 2019-01-16
modified: 2023-02-06
tags:
  - attack.stealth
  - attack.t1218.005
  - car.2013-02-003
  - car.2013-03-001
  - car.2014-04-003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \mshta.exe
  selection_child:
    - Image|endswith:
        - \cmd.exe
        - \powershell.exe
        - \pwsh.exe
        - \wscript.exe
        - \cscript.exe
        - \sh.exe
        - \bash.exe
        - \reg.exe
        - \regsvr32.exe
        - \bitsadmin.exe
    - OriginalFileName:
        - Cmd.Exe
        - PowerShell.EXE
        - pwsh.dll
        - wscript.exe
        - cscript.exe
        - Bash.exe
        - reg.exe
        - REGSVR32.EXE
        - bitsadmin.exe
  condition: all of selection*
falsepositives:
  - Printer software / driver installations
  - HP software
level: high
license: DRL-1.1
related:
  - id: 03cc0c25-389f-4bf8-b48d-11878079f1ca
    type: derived