Windows Process Creation: Suspicious Children Spawned by mshta.exe

Flags mshta.exe spawning command, script, or utility processes commonly abused for executing malicious HTA payloads.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Michael Haag (SigmaHQ), DRL 1.1
Published: 2019-01-16
Updated: 2026-07-30

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1218.005Mshta
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process creation events where the parent process is mshta.exe and the child process is one of several common command/script utilities (e.g., cmd.exe, PowerShell, wscript/cscript, bash/sh, reg.exe, regsvr32, bitsadmin). Attackers often abuse mshta.exe to execute malicious HTA content and then leverage these tools to run commands or stage payloads. The detection relies on Windows process creation telemetry, specifically parent image path endswith matching for mshta.exe and child image/original filename endswith or exact name matching.

Reporting behind it

Related detections9 linkedT1218.005 — drag to rearrange

Suspicious MSHTA Execution Spawned by Browser or Document Reader via Mispadu (via process_creation)

Suspicious Office Application Spawning Mshta With Remote HTA

Suspicious MSHTA VBScript WScript Shell Execution

Suspicious Remote HTA Payload Execution via MSHTA

Malicious Shell Spawned by Mshta Delivery (via process_creation)

Malicious Kimsuky Remote HTA Execution via URL Shortener (via process_creation)

ClickFix Paste-Jacking Execution of mshta Retrieving Remote Payload (via process_creation)

Suspicious mshta Execution of Remote HTA Payload

Suspicious Mshta Executed From Non-System Path (via process_creation)

Windows Process Creation: Suspicious Children Spawned by mshta.exe

Pivot detection · T1218.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-suspicious-children-spawned-by-mshta-exe-03cc0c25

title: "Windows Process Creation: Suspicious Children Spawned by mshta.exe"
id: d4ee7775-ea66-461a-b32e-40215cc2bf12
status: test
description: This rule identifies process creation events where the parent process is mshta.exe and the child process is one of several common command/script utilities (e.g., cmd.exe, PowerShell, wscript/cscript, bash/sh, reg.exe, regsvr32, bitsadmin). Attackers often abuse mshta.exe to execute malicious HTA content and then leverage these tools to run commands or stage payloads. The detection relies on Windows process creation telemetry, specifically parent image path endswith matching for mshta.exe and child image/original filename endswith or exact name matching.
references:
  - https://www.trustedsec.com/july-2015/malicious-htas/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mshta_susp_child_processes.yml
author: Michael Haag, Huntrule Team
date: 2019-01-16
modified: 2023-02-06
tags:
  - attack.stealth
  - attack.t1218.005
  - car.2013-02-003
  - car.2013-03-001
  - car.2014-04-003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \mshta.exe
  selection_child:
    - Image|endswith:
        - \cmd.exe
        - \powershell.exe
        - \pwsh.exe
        - \wscript.exe
        - \cscript.exe
        - \sh.exe
        - \bash.exe
        - \reg.exe
        - \regsvr32.exe
        - \bitsadmin.exe
    - OriginalFileName:
        - Cmd.Exe
        - PowerShell.EXE
        - pwsh.dll
        - wscript.exe
        - cscript.exe
        - Bash.exe
        - reg.exe
        - REGSVR32.EXE
        - bitsadmin.exe
  condition: all of selection*
falsepositives:
  - Printer software / driver installations
  - HP software
level: high
license: DRL-1.1
related:
  - id: 03cc0c25-389f-4bf8-b48d-11878079f1ca
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL