detection.wiki

Detection rules › Splunk

MSHTA.exe execution (PowerShell)

Group by
_time, host
Source
github.com/anvilogic-forge/armory

Detect use of MSHTA

MITRE ATT&CK coverage

TacticTechniques
StealthT1218.005 System Binary Proxy Execution: Mshta

References

Event coverage

ProviderEventTitle
PowerShellEvent ID 4103Payload Context: ContextInfo User Data: UserData.

Rule body yaml

id: '5982.29666'
title: MSHTA.exe execution
description: 'Detect use of MSHTA. -- Threat Actor Association: Actinium/Gamaredon/Primitive
  Bear, APT37, APT43, FIN7, Kimsuky, MuddyWater, TA551, TA576, UAC-0057 (GhostWriter),
  Wizard Spider -- Software Association: Bazar, Conti, PYSA/Mespinoza, Trickbot, XingLocker,
  Zloader Atomics T1218.005 Test#1 Atomics T1218.005 Test#2 Atomics T1218.005 Test#3
  Atomics T1218.005 Test#4 Atomics T1218.005 Test#5 Atomics T1218.005 Test#6 Atomics
  T1218.005 Test#7 Atomics T1218.005 Test#8 Atomics T1218.005 Test#9 Atomics T1218.005
  Test#10 Atomics T1059.001 Test #9 - #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<") (TERM(mshta.exe) OR TERM(mshta)) | table _time, host, user process,
  process_*, parent_*, signature_id, src_*, dest_* | bin span=1s | stats values(*)
  as * by _time, host | where match(process_name, "(?i)mshta") OR match(process, "(?i)mshta")
  OR (match(parent_process_name, "(?i)mshta") and match(process_name, "(?i)cmd|powershell")) '
techniques:
- defense-evasion:system binary proxy execution:mshta
technique_id:
- T1218.005
data_category:
- PowerShell logs
references:
- https://lolbas-project.github.io/lolbas/Binaries/Mshta/
- ired.team/offensive-security/code-execution/t1170-mshta-code-execution
- https://attackiq.com/2020/04/20/fingerprinting-fin7/

Stages and Predicates

Stage 1: search

`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR "<EventID>4103<") (TERM(mshta.exe) OR TERM(mshta))

Stage 2: table

| table _time, host, user process, process_*, parent_*, signature_id, src_*, dest_*

Stage 3: bucket

| bin span=1s

Stage 4: stats

| stats values(*) as * by _time, host

Stage 5: where

| where match(process_name, "(?i)mshta") OR match(process, "(?i)mshta") OR (match(parent_process_name, "(?i)mshta") and match(process_name, "(?i)cmd|powershell"))

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventCodeeq
  • 4103 corpus 105 (splunk 105)
parent_process_namematch
  • "(?i)mshta" corpus 3 (splunk 3)
processmatch
  • "(?i)mshta" corpus 3 (splunk 3)
process_namematch
  • "(?i)cmd|powershell" corpus 3 (splunk 3)
  • "(?i)mshta" corpus 3 (splunk 3)

Search terms

Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.

StageTerm
1TERM
1"<EventID>4103<"
1TERM
1mshta.exe
1TERM
1mshta