Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
434 detections
Filters
Last updated
All Time
Detection languages
205
119
33
24
18
Contributors
91
70
52
38
25
Categories
329
260
202
41
40
Platforms
424
6
4
4
1
Products / Services
167
126
91
19
9
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
2
2
2
1
1
IDS Classtypes
4
IDS Protocols
3
1
Microsoft Secure Score added a recommendation to block outbound traffic from mshta.exe in Microsoft Defender for Endpoint. This reduces risk from attacks using mshta.exe, requires admin action to enable, and impacts compliance monitoring and data access.
This rule detects potentially malicious use of the ClickOnce process (dfsvc.exe) by monitoring for suspicious parent processes (such as rundll32.exe or mshta.exe) spawning dfsvc.exe, or dfsvc.exe spawning unexpected child processes. ClickOnce is often abused by attackers to proxy the execution of malicious code, and these patterns are indicative of such activity.
Detects instances where common web browsers (Chrome, Edge, Firefox, Brave) spawn command-line tools or script interpreters (cmd, PowerShell, wscript, mshta) as child processes. This behavior is highly indicative of drive-by download attacks, including the 'ClickFix' technique, where users are socially engineered into executing malicious commands under the guise of fake browser updates or error resolution.
Detects social engineering lures (like ClickFix, FileFix, and CrashFix) where a user is tricked into manually executing a malicious payload. This rule specifically looks for script interpreters (powershell.exe, cmd.exe, mshta.exe, wscript.exe, cscript.exe) or Living Off The Land Binaries (LOLBins) (rundll32.exe, msiexec.exe, regsvr32.exe, curl.exe, certutil.exe, bitsadmin.exe) being spawned as child processes of web browsers (chrome.exe, msedge.exe, firefox.exe, iexplore.exe, brave.exe, opera.exe) or explorer.exe (indicating execution from a Run dialog). Exclusions are in place for common benign browser update processes.
Detects mshta.exe spawning from archive utilities (winrar.exe, 7z.exe) or Windows Explorer, or executing HTA files directly from common user-writable temporary or download directories. This pattern is commonly associated with the execution of malicious payloads delivered via compressed archives, a technique observed in campaigns attributed to the Turla threat group.
Detects the execution of known script host binaries (mshta.exe, wscript.exe, cscript.exe) from suspicious user-writable directories (Downloads, Temp, AppData, Desktop). The detection specifically looks for these binaries when spawned by common applications like archive utilities (7-zip, WinRAR, WinZip) or shell interfaces (explorer.exe, cmd.exe, powershell.exe), which is a common pattern for the execution of downloaded or extracted malicious payloads.
A detection triggered on endpoint events where common system binaries (e.g., mshta.exe, powershell.exe, cmd.exe) were launched by user-facing parent processes (explorer.exe, chrome.exe, msedge.exe, firefox.exe, iexplore.exe) and executed suspicious command-lines. The pattern matches the evolving technique used in ClickFix-style campaigns whereby malicious pages dynamically place payloads into the clipboard and prompt users to paste or execute them.
Detects the execution of mshta.exe with command-line arguments that indicate the execution of JavaScript or VBScript code, often used for malicious purposes such as bypassing application whitelisting or executing remote code.
Detects the execution of mshta.exe with command-line arguments that include remote protocols (http/https) or scripts (javascript/vbscript). This behavior is commonly associated with fileless malware execution and proxying malicious code via a trusted Windows binary.
Detects potential defense evasion using common Windows LOLBins (Living off the Land Binaries) to execute code from untrusted locations or remote sources. Specifically targets mshta.exe loading remote HTA files, regsvr32.exe performing Squiblydoo-style COM scriptlet execution via URL, and rundll32.exe executing DLLs from user-writable directories like Temp or AppData.
Detects script content that invokes 'mshta.exe' from the 'SysWOW64' directory to access a remote resource ending with '.7z' via HTTP or HTTPS. This pattern is associated with the Animateclipper malware, which uses MSHTA for initial access or execution of malicious scripts.
This rule detects potentially malicious use of the ClickOnce process (dfsvc.exe) by monitoring for suspicious parent processes (such as rundll32.exe or mshta.exe) spawning dfsvc.exe, or dfsvc.exe spawning unexpected child processes. ClickOnce is often abused by attackers to proxy the execution of malicious code, and these patterns are indicative of such activity.
A detection triggered on endpoint events where common system binaries (e.g., mshta.exe, powershell.exe, cmd.exe) were launched by user-facing parent processes (explorer.exe, chrome.exe, msedge.exe, firefox.exe, iexplore.exe) and executed suspicious command-lines. The pattern matches the evolving technique used in ClickFix-style campaigns whereby malicious pages dynamically place payloads into the clipboard and prompt users to paste or execute them.
Detects instances where common web browsers (Chrome, Edge, Firefox, Brave) spawn command-line tools or script interpreters (cmd, PowerShell, wscript, mshta) as child processes. This behavior is highly indicative of drive-by download attacks, including the 'ClickFix' technique, where users are socially engineered into executing malicious commands under the guise of fake browser updates or error resolution.
Detects the execution of mshta.exe with suspicious command-line arguments, including the use of 'javascript:', 'vbscript:', or HTTP/HTTPS URLs. These patterns are commonly used to proxy the execution of malicious HTML Applications (HTA) or scripts to bypass security controls. The rule includes an exclusion for legitimate Microsoft-signed mshta.exe processes that do not contain these suspicious indicators.
Detects the use of the Program Compatibility Assistant (pcalua.exe) to proxy the execution of mshta.exe. This LOLBIN evasion technique is actively used by ClickFix loaders to execute remote HTA payloads while evading process-based detections.
Detects execution of mshta.exe with a command-line containing a URL, which is a common technique used by attackers to proxy the execution of remote malicious payloads such as HTA, VBScript, or JScript files. The rule excludes common Microsoft domains to reduce false positives.
Detects instances where mshta.exe is used to launch suspicious child processes such as wscript.exe, cscript.exe, or powershell.exe, or is associated with HTA files or PteroSand-related indicators. This behavior is indicative of HTML smuggling or malicious HTA-based delivery of secondary payloads.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
Detects suspicious command-line executions involving common Windows system binaries (rundll32.exe, mshta.exe, certutil.exe, wmic.exe) combined with keywords often associated with network communication or data transfer (http, https, base64, /transfer). This pattern can indicate attempts at downloading malicious payloads, exfiltrating data, or executing encoded commands.
Detects the execution of mshta.exe with command-line arguments that indicate the execution of JavaScript or VBScript code, often used for malicious purposes such as bypassing application whitelisting or executing remote code.
Page 8 of 21