Windows Process Creation: mshta/VBScript Launching PowerShell and Embedded Backdoor Logic
Alerts on Windows command lines combining mshta VBScript execution bypass, system survey WMI queries, and PowerShell HTTP/Base64 patterns.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-03-10
- Updated
- 2026-07-31
What it detects
This rule flags Windows process creation events where the command line matches an mshta/VBScript pattern that invokes PowerShell with execution bypass and writes activity under the ProgramData directory. It also looks for follow-on discovery/backdoor indicators in the same command line, including WMI queries for system and network information and encoded payload handling using .NET Base64/UTF-8 and HTTP response streaming with HTTPWebRequest. This matters because such behaviors are commonly used to execute and stage malicious payloads while minimizing user visibility; detection relies on process creation telemetry with full command-line capture.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: mshta/VBScript Launching PowerShell and Embedded Backdoor Logic"
id: 0535490d-f634-4471-adad-87d0b8bb3f5e
status: test
description: This rule flags Windows process creation events where the command line matches an mshta/VBScript pattern that invokes PowerShell with execution bypass and writes activity under the ProgramData directory. It also looks for follow-on discovery/backdoor indicators in the same command line, including WMI queries for system and network information and encoded payload handling using .NET Base64/UTF-8 and HTTP response streaming with HTTPWebRequest. This matters because such behaviors are commonly used to execute and stage malicious payloads while minimizing user visibility; detection relies on process creation telemetry with full command-line capture.
references:
- https://www.mandiant.com/resources/blog/iranian-threat-group-updates-ttps-in-spear-phishing-campaign
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/TA/MuddyWater/proc_creation_win_apt_muddywater_activity.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-10
tags:
- attack.execution
- attack.stealth
- attack.g0069
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_mshta:
CommandLine|contains|all:
- vbscript:Close(Execute("CreateObject(
- powershell
- -w 1 -exec Bypass
- \ProgramData\
selection_survey:
CommandLine|contains|all:
- Win32_OperatingSystem
- Win32_NetworkAdapterConfiguration
- root\SecurityCenter2
- "[System.Net.DNS]"
selection_pwsh_backdoor:
CommandLine|contains|all:
- "[Convert]::ToBase64String"
- "[System.Text.Encoding]::UTF8.GetString]"
- GetResponse().GetResponseStream()
- "[System.Net.HttpWebRequest]::Create("
- "-bxor "
condition: 1 of selection_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 36222790-0d43-4fe8-86e4-674b27809543
type: derived