Office application started mshta.exe

Description

Office application started mshta.exe

Query · wazuh

field win.eventdata.originalFileName="(?i)mshta\.EXE" AND field win.eventdata.parentImage="(?i)(winword|excel|powerpnt)\.EXE"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

  1. 92047 Office application started mshta.exe anchor level 12 this rule
    field win.eventdata.originalFileName="(?i)mshta\.EXE" AND field win.eventdata.parentImage="(?i)(winword|excel|powerpnt)\.EXE"

Refined by

1 rule chains off this one, narrowing it further.

Rule dependencies

Depends on

  • composes · Wazuh if_group sysmon_event1
    856 rules in this analytic story
Raw source Office application started mshta.exe · Wazuh XML
Esc
Published by Wazuh Core Ruleset ↗, licensed under GPLv2 ↗. Reproduced here unmodified. 
<rule id="92047" level="12">
    <if_group>sysmon_event1</if_group>
    <field name="win.eventdata.originalFileName" type="pcre2">(?i)mshta\.EXE</field>
    <field name="win.eventdata.parentImage" type="pcre2">(?i)(winword|excel|powerpnt)\.EXE</field>
    <options>no_full_log</options>
    <description>Office application started mshta.exe</description>
    <mitre>
      <id>T1218.005</id>
    </mitre>
  </rule>

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.