T1218.005 System Binary Proxy Execution: Mshta

Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. MITRE ATT&CK

2 programs on CmdID 7 Sigma rules T1218.005 on attack.mitre.org

Part of

MITRE ATT&CK

T1218System Binary Proxy Execution

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

highCsc.EXE Execution Form Potentially Suspicious ParentFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) · Windows

highMSHTA Execution with Suspicious File ExtensionsDiego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems) · Windows

highPotential Baby Shark Malware ActivityFlorian Roth (Nextron Systems) · Windows

highRemotely Hosted HTA File Executed Via Mshta.EXENasreddine Bencherchali (Nextron Systems) · Windows

highSuspicious JavaScript Execution Via Mshta.EXEE.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community · Windows