Identified Network Connections via Mshta Execution
The detection functionality is specifically on the zscaler a notable proxy, depending on the proxy technology being leveraged, this could perhaps be used for others. The detection's focus is anchored what the HTTP content is, and its associated user-agent which is tied to MSHTA Execution. We couple these because using the user-agent alone, is too general resulting in a massive amount of events. Coupling the content focusing on HTA does in fact hone in on pulling an hta payload down into the environment. mshta.exe (Microsoft HTML Application Host) is a legitimate Windows utility used to execute HTML Application (HTA) files and can also be used to run scripts, such as JavaScript or VBScript, directly from the command line. This technique involves abusing mshta.exe, a legitimate Windows utility, to execute malicious scripts or commands by proxy. Since mshta.exe is Microsoft-signed, attackers use it to bypass security tools or avoid detection (a technique known as living off the land).
Splunk (SPL)
