Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
2
1
Platforms
2
Products / Services
2
MITRE Techniques
2
2
2
2
2
CVEs
71
71
64
58
49
Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content,
such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications
containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and
execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.
such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications
containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and
execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.
Detects the execution of mshta.exe with command-line arguments that include file extensions not typically associated with HTML Application (HTA) content, such as image files (.png, .jpg), archives (.zip), documents (.pdf), and others. This behavior is often indicative of adversaries abusing mshta.exe, a legitimate Windows utility, to execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.