detect-suspicious-mshta-usage

Description

This query was originally published in the threat analytics report, Ursnif (Gozi) continues to evolve. Microsoft HTML Applications, or HTAs, are executable files that use the same technologies and models as Internet Explorer, but do not run inside of a web browser. Mshta.exe is a Windows utility that provides a host for HTA files to run in. Although it has legitimate uses, attackers can use mshta.exe to run malicious Javascript or VBScript commands. The MITRE ATT&CK framework includes Mshta among its list of enterprise attack techniques. The following query detects when mshta.exe has been run, which might include illegitimate usage by attackers. References: https://docs.microsoft.com/previous-versions/ms536496(v=vs.85) https://attack.mitre.org/techniques/T1170/

Query · kql

// mshta.exe script launching processes
DeviceProcessEvents 
| where Timestamp > ago(7d)
and InitiatingProcessFileName =~ 'mshta.exe'
and InitiatingProcessCommandLine contains '<script>'
Raw source detect-suspicious-mshta-usage · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 9462573d-09e3-4878-a118-db5c964228e0
name: detect-suspicious-mshta-usage
description: |
  This query was originally published in the threat analytics report, Ursnif (Gozi) continues to evolve.
  Microsoft HTML Applications, or HTAs, are executable files that use the same technologies and models as Internet Explorer, but do not run inside of a web browser.
  Mshta.exe is a Windows utility that provides a host for HTA files to run in. Although it has legitimate uses, attackers can use mshta.exe to run malicious Javascript or VBScript commands. The MITRE ATT&CK framework includes Mshta among its list of enterprise attack techniques.
  The following query detects when mshta.exe has been run, which might include illegitimate usage by attackers.
  References:
  https://docs.microsoft.com/previous-versions/ms536496(v=vs.85)
  https://attack.mitre.org/techniques/T1170/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Execution
- Execution
query: |
  // mshta.exe script launching processes
  DeviceProcessEvents 
  | where Timestamp > ago(7d)
  and InitiatingProcessFileName =~ 'mshta.exe'
  and InitiatingProcessCommandLine contains '<script>'

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.