Hide Navigation Hide TOC

Suspicious MSHTA Child Process (03cc0c25-389f-4bf8-b48d-11878079f1ca)

Detects a suspicious process spawning from an "mshta.exe" process, which could be indicative of a malicious HTA script execution

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Mshta - T1218.005 (840a987a-99bd-4a80-a5c9-0cb2baa6cade)	Attack Pattern	Suspicious MSHTA Child Process (03cc0c25-389f-4bf8-b48d-11878079f1ca)	Sigma-Rules	1
Mshta - T1218.005 (840a987a-99bd-4a80-a5c9-0cb2baa6cade)	Attack Pattern	System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4)	Attack Pattern	2