Windows System Service Creation Using MSHTA with VBScript CreateObject

title: Windows System Service Creation Using MSHTA with VBScript CreateObject
id: 24f9821e-3273-4399-a8d0-bee8523226e8
status: test
description: This rule identifies service creation events where the service binary path contains mshta and the VBScript pattern vbscript:createobject. Attackers can use mshta to execute HTML/JavaScript-based payloads and obfuscate execution by embedding or invoking script objects. It relies on Windows System logs reporting Service Control Manager activity (Event ID 7045) including the ImagePath for the newly created service.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_mshta_services.yml
author: Nikita Nazarov, oscd.community, Huntrule Team
date: 2020-10-09
modified: 2022-11-29
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ImagePath|contains|all:
      - mshta
      - vbscript:createobject
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7e9c7999-0f9b-4d4a-a6ed-af6d553d4af4
    type: derived