Windows Process: Obfuscated PowerShell Command invoking MSHTA VBScript from Script

title: "Windows Process: Obfuscated PowerShell Command invoking MSHTA VBScript from Script"
id: 0222287f-08fa-43e8-9cf2-b10f29d41569
status: test
description: This rule matches process creation command lines that contain a specific obfuscated script pattern, including PowerShell use of MSHTA, VBScript CreateObject, .run, and window.close along with 'set' and '&&'. Attackers commonly use MSHTA with VBScript to execute code while reducing visibility, and chaining command segments can further obscure intent. The detection relies on Windows process creation telemetry with the full command line.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_use_mhsta.yml
author: Nikita Nazarov, oscd.community, Huntrule Team
date: 2020-10-08
modified: 2022-03-08
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - set
      - "&&"
      - mshta
      - vbscript:createobject
      - .run
      - (window.close)
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: ac20ae82-8758-4f38-958e-b44a3140ca88
    type: derived