HUNTS- Mshta (T1170)

HUNTS- Mshta (T1170)

Version 1.0

ATT&CK Technique: Mshta (T1170)

What this playbook hunts for:

• Processes spawned by mshta.exe. Mshta can be used to load malicious .hta files which may contain scripts. Mshta.exe is an example of a Living of the Land (LOL) binary, which are native Windows executables that are rarely blocked by Applocker or anti-virus software.

• Invocations of mshta.exe. Mshta.exe can be utilized via the command line to download files and execute their content, giving an attacker an execution mechanism.

How the playbook works:

• Generates SIEM query for Sysmon Event ID 1 logs where mshta.exe is the parent process of an executed file

• Generates SIEM query for Sysmon Event ID 1 logs where mshta is invoked via the command line

What results are expected:

• Name, process ID, and path of the process spawned by mshta.exe

• Command line arguments containing mshta

• MD5 hash of the process spawned by mshta.exe

• Child process spawn time

• Hostname of the computer where mshta.exe was executed

• User account that was used to execute mshta.exe

Common follow-on actions:

• Acquire forensic image

• Sandbox file

• Get running processes

• Get network connections

• Quarantine host

What inputs are necessary:

• SIEM

• Logs: Sysmon Event ID 1: Process creation

• Hunt start time

What subroutine playbooks are needed:

• Create and Link Alerts from Hunt (Host-based)

What configurations are needed:

• Sysmon logging enabled 

False Positive Potential: Low

• Execution of mshta.exe is uncommon on most networks. Child processes spawned by mshta.exe are even more uncommon and should absolutely be investigated if observed.