MSHTA.exe execution (Windows Event Log)

id: '5982.6332'
title: MSHTA.exe execution
description: 'Detect use of MSHTA. -- Threat Actor Association: Actinium/Gamaredon/Primitive
  Bear, APT37, APT43, FIN7, Kimsuky, MuddyWater, TA551, TA576, UAC-0057 (GhostWriter),
  Wizard Spider -- Software Association: Bazar, Conti, PYSA/Mespinoza, Trickbot, XingLocker,
  Zloader Atomics T1218.005 Test#1 Atomics T1218.005 Test#2 Atomics T1218.005 Test#3
  Atomics T1218.005 Test#4 Atomics T1218.005 Test#5 Atomics T1218.005 Test#6 Atomics
  T1218.005 Test#7 Atomics T1218.005 Test#8 Atomics T1218.005 Test#9 Atomics T1218.005
  Test#10 Atomics T1059.001 Test #9 - #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(mshta.exe) OR TERM(mshta)) | table _time,
  host, user process, process_*, parent_*, signature_id, src_*, dest_* | bin span=1s
  | stats values(*) as * by _time, host | where match(process_name, "(?i)mshta") OR
  match(process, "(?i)mshta") OR (match(parent_process_name, "(?i)mshta") and match(process_name,
  "(?i)cmd|powershell")) '
techniques:
- defense-evasion:system binary proxy execution:mshta
technique_id:
- T1218.005
data_category:
- Windows event logs
references:
- https://lolbas-project.github.io/lolbas/Binaries/Mshta/
- ired.team/offensive-security/code-execution/t1170-mshta-code-execution
- https://attackiq.com/2020/04/20/fingerprinting-fin7/