Skip to content

Hide Navigation Hide TOC

Mshta (f552a5a4-49dd-4ba6-9916-e631df4d4457)

This object contains information sourced from the Living Off The Land Binaries, Scripts and Libraries (LOLBAS) project, which is licensed under GNU General Public License v3.0.

Description: Used by Windows to execute html applications. (.hta)

Author: Oddvar Moe

Paths: * C:\Windows\System32\mshta.exe * C:\Windows\SysWOW64\mshta.exe

Resources: * https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_4 * https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Payloads/mshta.sct * https://oddvar.moe/2017/12/21/applocker-case-study-how-insecure-is-it-really-part-2/ * https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/

Detection: * Sigma: proc_creation_win_mshta_susp_pattern.yml * Sigma: proc_creation_win_hktl_invoke_obfuscation_via_use_mhsta.yml * Sigma: proc_creation_win_mshta_lethalhta_technique.yml * Sigma: proc_creation_win_mshta_javascript.yml * Sigma: file_event_win_net_cli_artefact.yml * Sigma: image_load_susp_script_dotnet_clr_dll_load.yml * Elastic: defense_evasion_mshta_beacon.toml * Elastic: lateral_movement_dcom_hta.toml * Elastic: defense_evasion_suspicious_managedcode_host_process.toml * Splunk: suspicious_mshta_activity.yml * Splunk: detect_mshta_renamed.yml * Splunk: suspicious_mshta_spawn.yml * Splunk: suspicious_mshta_child_process.yml * Splunk: detect_mshta_url_in_command_line.yml * BlockRule: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules * IOC: mshta.exe executing raw or obfuscated script within the command-line * IOC: General usage of HTA file * IOC: msthta.exe network connection to Internet/WWW resource * IOC: DotNet CLR libraries loaded into mshta.exe * IOC: DotNet CLR Usage Log - mshta.exe.log[LOLBAS Mshta]

Cluster A Galaxy A Cluster B Galaxy B Level
Mshta (f552a5a4-49dd-4ba6-9916-e631df4d4457) Tidal Software MuddyWater (dcb260d8-9d53-404f-9ff5-dbee2c6effe6) Tidal Groups 1
Mshta (f552a5a4-49dd-4ba6-9916-e631df4d4457) Tidal Software Kimsuky (37f317d8-02f0-43d4-8a7d-7a65ce8aadf1) Tidal Groups 1
Mshta (f552a5a4-49dd-4ba6-9916-e631df4d4457) Tidal Software Mustang Panda (4a4641b1-7686-49da-8d83-00d8013f4b47) Tidal Groups 1
Mshta (f552a5a4-49dd-4ba6-9916-e631df4d4457) Tidal Software Earth Lusca (646e35d2-75de-4c1d-8ad3-616d3e155c5e) Tidal Groups 1
Mshta (f552a5a4-49dd-4ba6-9916-e631df4d4457) Tidal Software APT29 (4c3e48b9-4426-4271-a7af-c3dfad79f447) Tidal Groups 1
Lazarus Group (0bc66e95-de93-4de7-b415-4041b7191f08) Tidal Groups Mshta (f552a5a4-49dd-4ba6-9916-e631df4d4457) Tidal Software 1
Mshta (f552a5a4-49dd-4ba6-9916-e631df4d4457) Tidal Software LazyScripter (12279b62-289e-49ee-97cb-c780edd3d091) Tidal Groups 1
Mshta (f552a5a4-49dd-4ba6-9916-e631df4d4457) Tidal Software SideCopy (31bc763e-623f-4870-9780-86e43d732594) Tidal Groups 1
Mshta (f552a5a4-49dd-4ba6-9916-e631df4d4457) Tidal Software FIN7 (4348c510-50fc-4448-ab8d-c8cededd19ff) Tidal Groups 1
Mshta (f552a5a4-49dd-4ba6-9916-e631df4d4457) Tidal Software APT32 (c0fe9859-e8de-4ce1-bc3c-b489e914a145) Tidal Groups 1
Mshta (f552a5a4-49dd-4ba6-9916-e631df4d4457) Tidal Software Sidewinder (44f8bd4e-a357-4a76-b031-b7455a305ef0) Tidal Groups 1
Mshta (f552a5a4-49dd-4ba6-9916-e631df4d4457) Tidal Software TA551 (8951bff3-c444-4374-8a9e-b2115d9125b2) Tidal Groups 1
Mshta (f552a5a4-49dd-4ba6-9916-e631df4d4457) Tidal Software Gamaredon Group (41e8b4a4-2d31-46ee-bc56-12375084d067) Tidal Groups 1
Mshta (f552a5a4-49dd-4ba6-9916-e631df4d4457) Tidal Software Phobos Ransomware Actors (f138c814-48c0-4638-a4d6-edc48e7ac23a) Tidal Groups 1
Mshta (f552a5a4-49dd-4ba6-9916-e631df4d4457) Tidal Software Confucius (d0f29889-7a9c-44d8-abdc-480b371f7b2b) Tidal Groups 1