AN1397
Analytic 1397
Windows
Detection of mshta.exe execution where command-line arguments reference remote or local HTA/script content (VBScript/JScript) followed by subsequent file creation, network retrieval, or process spawning that indicates payload execution outside standard Internet Explorer security context. Correlation includes parent process lineage, command-line inspection, and network connection creation to untrusted or anomalous endpoints.
WinEventLog:Security
EventCode=4688
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Sysmon
EventCode=11
[CommandLinePattern]
Regex patterns for mshta.exe arguments referencing remote HTA/script content; may need tuning to exclude known-good internal scripts.
[SuspiciousParentProcesses]
List of parent processes considered suspicious when spawning mshta.exe (e.g., Office applications, script interpreters).
[AllowedHTASources]
Whitelist of domains/paths from which legitimate HTAs are executed.
[TimeWindow]
Time threshold for correlating mshta.exe execution with subsequent network connections or file creations.