Windows: Suspicious HTA File Creation in Startup Folder by FoxitPDFReader.exe

Alerts on FoxitPDFReader.exe creating .hta files in the Startup Programs folder, which can indicate persistence.

FreeUnreviewedSigmahighv1

windows-suspicious-hta-file-creation-in-startup-folder-by-foxitpdfreader-exe-9cae055f

title: "Windows: Suspicious HTA File Creation in Startup Folder by FoxitPDFReader.exe"
id: e14914da-dc55-4151-a19c-e5436905f2ff
status: test
description: This rule flags creation of .hta files within the Windows Startup Programs directory when the creating process is FoxitPDFReader.exe. Malicious use of script-based HTA payloads placed in Startup locations can provide persistence by executing on user login. The detection relies on Windows file creation telemetry capturing the process image path and the target filename/path.
references:
  - https://github.com/j00sean/SecBugs/tree/ff72d553f75d93e1a0652830c0f74a71b3f19c46/CVEs/CVE-2023-27363
  - https://www.zerodayinitiative.com/advisories/ZDI-23-491/
  - https://www.tarlogic.com/blog/cve-2023-27363-foxit-reader/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-27363/file_event_win_cve_2023_27363_foxit_rce.yml
author: Gregory, Huntrule Team
date: 2023-10-11
tags:
  - attack.persistence
  - attack.t1505.001
  - cve.2023-27363
  - detection.emerging-threats
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith: \FoxitPDFReader.exe
    TargetFilename|contains: \Microsoft\Windows\Start Menu\Programs\Startup\
    TargetFilename|endswith: .hta
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 9cae055f-e1d2-4f81-b8a5-1986a68cdd84
    type: derived

What it detects

This rule flags creation of .hta files within the Windows Startup Programs directory when the creating process is FoxitPDFReader.exe. Malicious use of script-based HTA payloads placed in Startup locations can provide persistence by executing on user login. The detection relies on Windows file creation telemetry capturing the process image path and the target filename/path.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.