Sigma rule: MSHTA Execution with Suspicious File Extensions

Rule

Title

MSHTA Execution with Suspicious File Extensions

Status

test

Level

high

Author

Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2019-02-22

Modified

2025-05-12

File

rules/windows/process_creation/proc_creation_win_mshta_susp_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content,
such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications
containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and
execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith: '\mshta.exe'
    - OriginalFileName: 'mshta.exe'
selection_cli:
    CommandLine|contains:
        - '.7z'
        - '.avi'
        - '.bat'
        - '.bmp'
        - '.conf'
        - '.csv'
        - '.dll'
        - '.doc'
        - '.gif'
        - '.gz'
        - '.ini'
        - '.jpe'
        - '.jpg'
        - '.json'
        - '.lnk'
        - '.log'
        - '.mkv'
        - '.mp3'
        - '.mp4'
        - '.pdf'
        - '.png'
        - '.ppt'
        - '.rar'
        - '.rtf'
        - '.svg'
        - '.tar'
        - '.tmp'
        - '.txt'
        - '.xls'
        - '.xml'
        - '.yaml'
        - '.yml'
        - '.zip'
        - 'vbscript'
        # - '.chm'  # could be prone to false positives
        # - '.exe'
condition: all of selection_*

False positives (as the rule lists them)

• False positives depend on scripts and administrative tools used in the monitored environment

Tags

• attack.stealth
• attack.t1140
• attack.t1218.005
• attack.execution
• attack.t1059.007
• cve.2020-1599

CVEs this rule names

• CVE-2020-1599

MITRE ATT&CK ids this rule names

• T1059.007
• T1140
• T1218.005

References

• http://blog.sevagas.com/?Hacking-around-HTA-files
• https://0x00sec.org/t/clientside-exploitation-in-2018-how-pentesting-has-changed/7356
• https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/xml/xslt/xslt-stylesheet-scripting-using-msxsl-script
• https://medium.com/tsscyber/pentesting-and-hta-bypassing-powershell-constrained-language-mode-53a42856c997
• https://twitter.com/mattifestation/status/1326228491302563846
• https://www.virustotal.com/gui/file/c1f27d9795a2eba630db8a043580a0761798f06370fb1317067805f8a845b00c

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_mshta_susp_execution.yml