Elastic high stable eql

Suspicious Microsoft HTML Application Child Process

Identifies Mshta.exe spawning a suspicious child process. This may indicate adversarial activity, as Mshta is often leveraged by adversaries to execute malicious scripts and evade detection.

View Source

Detection Logic

process where host.os.type == "windows" and event.type == "start" and
  process.parent.name : "mshta.exe" and process.command_line != null and
  (
   process.name : (
       "cmd.exe", "powershell.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "msiexec.exe",
       "schtasks.exe", "reg.exe", "wscript.exe", "rundll32.exe"
   ) or
   process.executable : ("C:\\Users\\*\\*.exe", "\\Device\\HarddiskVolume*\\Users\\*\\*.exe")
  ) and
  not (process.name : "cmd.exe" and process.command_line : "*\\HP\\HP*HPUDC*") and
  not ?process.parent.command_line : "*\\HP\\*\\HPSolutionsPortal.hta*"

Field Validations

Loading…

Comments (0)

Loading comments...