Windows process creation: Suspicious mshta + PowerShell and system survey behavior

title: "Windows process creation: Suspicious mshta + PowerShell and system survey behavior"
id: 0535490d-f634-4471-adad-87d0b8bb3f5e
status: test
description: "This rule flags Windows process creation commands that match a specific sequence: mshta running embedded VBScript that launches PowerShell with execution bypass, combined with attempts to enumerate local OS/network security/WMI details and backdoor-like PowerShell behavior using Base64 and HTTP web requests. Such chaining can indicate scripted execution, stealthy recon, and potential command-and-control staging by an attacker. It relies on process creation telemetry with full command line logging to match the defined command-line substrings."
references:
  - https://www.mandiant.com/resources/blog/iranian-threat-group-updates-ttps-in-spear-phishing-campaign
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/TA/MuddyWater/proc_creation_win_apt_muddywater_activity.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-10
tags:
  - attack.execution
  - attack.stealth
  - attack.g0069
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_mshta:
    CommandLine|contains|all:
      - vbscript:Close(Execute("CreateObject(
      - powershell
      - -w 1 -exec Bypass
      - \ProgramData\
  selection_survey:
    CommandLine|contains|all:
      - Win32_OperatingSystem
      - Win32_NetworkAdapterConfiguration
      - root\SecurityCenter2
      - "[System.Net.DNS]"
  selection_pwsh_backdoor:
    CommandLine|contains|all:
      - "[Convert]::ToBase64String"
      - "[System.Text.Encoding]::UTF8.GetString]"
      - GetResponse().GetResponseStream()
      - "[System.Net.HttpWebRequest]::Create("
      - "-bxor "
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 36222790-0d43-4fe8-86e4-674b27809543
    type: derived