huntrule

Windows Process Creation: svchost.exe Spawns mshta.exe (LethalHTA)

Alerts on Windows instances where svchost.exe spawns mshta.exe, indicating potential LethalHTA execution.

FreeUnreviewedSigmahighv1
title: "Windows Process Creation: svchost.exe Spawns mshta.exe (LethalHTA)"
id: 30c44695-9aff-4cec-83d5-2c39092a9753
status: test
description: This rule flags process creation events where svchost.exe (parent) launches mshta.exe (child), matching a potential LethalHTA-style execution chain. Attackers may use mshta to run hostile script content via signed Microsoft binaries, aiming for stealth and user/process trust. The detection relies on Windows process creation telemetry that provides parent and child process image paths.
references:
  - https://codewhitesec.blogspot.com/2018/07/lethalhta.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mshta_lethalhta_technique.yml
author: Markus Neis, Huntrule Team
date: 2018-06-07
modified: 2023-02-07
tags:
  - attack.stealth
  - attack.t1218.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \svchost.exe
    Image|endswith: \mshta.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: ed5d72a6-f8f4-479d-ba79-02f6a80d7471
    type: derived

What it detects

This rule flags process creation events where svchost.exe (parent) launches mshta.exe (child), matching a potential LethalHTA-style execution chain. Attackers may use mshta to run hostile script content via signed Microsoft binaries, aiming for stealth and user/process trust. The detection relies on Windows process creation telemetry that provides parent and child process image paths.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.