Mshta Remote Script Execution via HTTP
This rule detects HTTP traffic where the User-Agent header contains "MSHTML", indicating potential remote script execution via Mshta. Mshta.exe is a Microsoft utility that can execute HTML Application (HTA) files, which can contain scripts. Attackers often abuse Mshta to execute malicious scripts, bypassing traditional execution policies. The rule specifically looks for outbound HTTP connections from the internal network ($HOME_NET) to any external destination, where the User-Agent string includes "MSHTML" (case-insensitive). This behavior is commonly associated with trojan activity and defense evasion tactics.
Suricata
