Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
434 detections
Filters
Last updated
All Time
Detection languages
205
119
33
24
18
Contributors
91
70
52
38
25
Categories
329
260
202
41
40
Platforms
424
6
4
4
1
Products / Services
167
126
91
19
9
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
2
2
2
1
1
IDS Classtypes
4
IDS Protocols
3
1
Detects mshta.exe launched with an inline javascript: one-liner that chains MSXML2.XMLHTTP to download, ADODB.Stream to write to disk, and WScript.Shell to execute. This identifies the ClickFix social engineering variant that fetches and executes payloads without using PowerShell.
Detects mshta.exe executing a remote HTA payload over HTTP/HTTPS, the initial fileless execution stage of ACR Stealer's Campaign 2. The retrieved HTA contains VBScript loaders that ultimately deploy obfuscated PowerShell and steganography-assisted in-memory shellcode.
The following analytic detects the use of Microsoft HTML Application Host (mshta.exe) to make remote HTTP or HTTPS connections. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line arguments containing URLs. This activity is significant because adversaries often use mshta.exe to download and execute remote .hta files, bypassing security controls. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further network infiltration.
The following analytic identifies child processes spawned from "mshta.exe". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific child processes like "powershell.exe" and "cmd.exe". This activity is significant because "mshta.exe" is often exploited by attackers to execute malicious scripts or commands. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence within the environment. Monitoring this activity helps in early detection of potential threats leveraging "mshta.exe" for malicious purposes.
The following analytic detects the execution of "mshta.exe" with inline protocol handlers such as "JavaScript", "VBScript", and "About". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line arguments and process details. This activity is significant because mshta.exe can be exploited to execute malicious scripts, potentially leading to unauthorized code execution. If confirmed malicious, this could allow an attacker to execute arbitrary code, escalate privileges, or establish persistence within the environment, posing a severe security risk.
Detects Microsoft Office applications (Word, Excel, Outlook, PowerPoint) spawning common LOLBins or command-line interpreters. This behavior is frequently associated with malicious macros or exploitation attempts delivering secondary payloads.
Detects the ClickFix/fake-CAPTCHA initial access pattern where users are socially engineered into copying and pasting malicious commands into the Windows Run dialog or a browser-spawned shell. The rule matches on process creation events involving mshta.exe, powershell.exe, or wscript.exe initiated by explorer.exe or common shell-related processes, filtering out known administrative and deployment software.
Detects HTTP GET requests for files with a .hta extension, utilizing a legacy Internet Explorer User-Agent string. This pattern is commonly associated with SideCopy threat group activities where mshta.exe is used to proxy the execution of remotely hosted malicious HTA files, often as part of an initial infection chain.
Detects DNS queries for the domain 'docsportal.in', which is associated with the SideCopy threat group's HTA-staging activity for delivering the ReverseRAT malware.
This analytic detects suspicious use of 'mshta.exe' or 'rundll32.exe' invoking 'mshtml.dll'
or the 'RunHTMLApplication' export without including a direct HTTP/HTTPS URL in the command line.
This pattern could be associated with obfuscated script execution used by threat actors during
initial access or payload staging. The absence of a visible URL may indicate attempts to evade static
detections by embedding the URL via string concatenation, encoding (e.g., hex), or indirect script loaders
like 'GetObject()'.
or the 'RunHTMLApplication' export without including a direct HTTP/HTTPS URL in the command line.
This pattern could be associated with obfuscated script execution used by threat actors during
initial access or payload staging. The absence of a visible URL may indicate attempts to evade static
detections by embedding the URL via string concatenation, encoding (e.g., hex), or indirect script loaders
like 'GetObject()'.
Detects the execution of known Windows 'Living-off-the-Land' binaries (rundll32.exe, regsvr32.exe, mshta.exe) when they originate from web browsers or office productivity applications, or when they are executed with command-line arguments indicative of network resource loading, remote scripting, or code execution bypasses.
Detects the execution of mshta.exe with arguments pointing to remote URLs or containing JavaScript. This behavior is commonly associated with phishing campaigns where attackers use fake CAPTCHA lures to trick users into executing malicious scripts via mshta.exe, often launched directly from Windows Explorer (e.g., from a downloaded file).
Detects instances where AI agent runtime processes (e.g., Python, Node.js) initiate child processes using common Windows Living-off-the-Land Binaries (LOLBAS). This behavior may indicate an AI agent has been compromised or misused to execute unauthorized system commands for defense evasion or post-exploitation activities.
Detects the suspicious execution of common Windows system binaries (LOLBAS) often used for proxying malicious code execution or deobfuscating payloads. This includes regsvr32.exe for remote scriptlet execution, mshta.exe for remote HTA execution, rundll32.exe for JavaScript or DLL function execution, and certutil.exe for decoding or retrieving remote files.
Detects a suspicious process chain where a web browser spawns the Windows Explorer process (typically representing a file dialog) which then immediately spawns a command interpreter (cmd.exe, powershell.exe, or mshta.exe). This pattern is consistent with ClickFix or similar attacks where a user is tricked into pasting a malicious command into a browser-triggered file selection window address bar.
Detects the execution of known Windows 'Living-off-the-Land' binaries (rundll32.exe, regsvr32.exe, mshta.exe) when they originate from web browsers or office productivity applications, or when they are executed with command-line arguments indicative of network resource loading, remote scripting, or code execution bypasses.
Detects ClickFix-style social engineering attacks where users are tricked into pasting malicious payloads into the Windows Run dialog. The rule monitors for common scripting interpreters (powershell.exe, cmd.exe, mshta.exe, rundll32.exe) spawned by explorer.exe or mstsc.exe with suspicious command-line patterns indicative of payload delivery, such as obfuscated strings, hidden windows, or short-URL downloads.
Detects a suspicious sequence of browser navigation/redirection events followed shortly by the manual execution of command-line utilities (PowerShell, CMD, or MSHTA) via explorer.exe, characteristic of 'ClickFix' social engineering attacks where users are tricked into copying and executing commands from their clipboard.
This rule detects the invocation of rundll32.exe, regsvr32.exe, or mshta.exe with arguments pointing to remote resources (UNC, WebDAV, or HTTP(S) URLs). This pattern is commonly used by attackers to execute remote scriptlets (e.g., .sct, .hta, .dll) for living-off-the-land bypasses or initial staging of malicious payloads, such as the Squiblytwo or Squiblydoo techniques.
Detects instances of mshta.exe initiating network connections to cloud storage providers (CloudFront, Cloudflare R2/pages) to retrieve multiple remote files (specifically .js or .txt). This behavior is indicative of an exploit stage where mshta.exe is used as a LOLBAS to fetch orchestrator scripts and gadget payloads for memory-based deserialization attacks.
Detects mshta.exe, wscript.exe, or cscript.exe initiating network connections to common CDN infrastructure (Cloudflare R2, CloudFront, pages.dev) to retrieve scripts (js, txt, log). This behavior is indicative of a staging phase in a malicious orchestration, often associated with subsequent deserialization attacks and DLL sideloading.
Page 1 of 21