detect_mshta_url_in_command_line.yml

name: Detect MSHTA Url in Command Line
id: 9b3af1e6-5b68-11eb-ae93-0242ac130002
version: 2
date: '2021-09-16'
author: Michael Haag, Splunk
status: production
type: TTP
description: This analytic identifies when Microsoft HTML Application Host (mshta.exe)
  utility is used to make remote http connections. Adversaries may use mshta.exe to
  proxy the download and execution of remote .hta files. The analytic identifies command
  line arguments of http and https being used. This technique is commonly used by
  malicious software to bypass preventative controls. The search will return the first
  time and last time these command-line arguments were used for these executions,
  as well as the target system, the user, process "rundll32.exe" and its parent process.
data_source:
- Sysmon Event ID 1
search:
  selection1:
    OriginalFileName: MSHTA.EXE
  selection2:
    Image|endswith: mshta.exe
  selection3:
    CommandLine:
    - '*http://*'
    - '*https://*'
  condition: (selection1 or selection2) and selection3
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
  endpoint product.
known_false_positives: It is possible legitimate applications may perform this behavior
  and will need to be filtered.
references:
- https://github.com/redcanaryco/AtomicTestHarnesses
- https://redcanary.com/blog/introducing-atomictestharnesses/
- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
tags:
  analytic_story:
  - Suspicious MSHTA Activity
  - Living Off The Land
  asset_type: Endpoint
  confidence: 100
  impact: 80
  message: An instance of $parent_process_name$ spawning $process_name$ was identified
    on endpoint $est$ by user $user$ attempting to access a remote destination to
    download an additional payload.
  mitre_attack_id:
  - T1218
  - T1218.005
  observable:
  - name: user
    type: User
    role:
    - Victim
  - name: dest
    type: Hostname
    role:
    - Victim
  - name: parent_process_name
    type: Process
    role:
    - Parent Process
  - name: process_name
    type: Process
    role:
    - Child Process
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 80
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog