Script Execution via Microsoft HTML Application

  1[metadata]
  2creation_date = "2020/09/09"
  3integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the execution of scripts via HTML applications using Windows utilities rundll32.exe or mshta.exe. Adversaries
 11may bypass process and/or signature-based defenses by proxying execution of malicious content with signed binaries.
 12"""
 13from = "now-9m"
 14index = [
 15    "logs-m365_defender.event-*",
 16    "logs-sentinel_one_cloud_funnel.*",
 17    "logs-system.security*",
 18    "logs-windows.forwarded*",
 19    "logs-windows.sysmon_operational-*",
 20    "winlogbeat-*",
 21    "logs-endpoint.events.process-*",
 22    "logs-crowdstrike.fdr*",
 23    "endgame-*"
 24]
 25language = "eql"
 26license = "Elastic License v2"
 27name = "Script Execution via Microsoft HTML Application"
 28risk_score = 73
 29rule_id = "181f6b23-3799-445e-9589-0018328a9e46"
 30severity = "high"
 31tags = [
 32    "Domain: Endpoint",
 33    "OS: Windows",
 34    "Use Case: Threat Detection",
 35    "Tactic: Defense Evasion",
 36    "Data Source: Windows Security Event Logs",
 37    "Data Source: Sysmon",
 38    "Data Source: SentinelOne",
 39    "Data Source: Microsoft Defender XDR",
 40    "Data Source: Elastic Defend",
 41    "Data Source: Crowdstrike",
 42    "Resources: Investigation Guide",
 43    "Data Source: Elastic Endgame",
 44    "Noise: Low",
 45    "Performance: Normal",
 46    "Profile: Recommended",
 47    "Threat: Living off the Land",
 48    "Rule Type: Event Correlation (EQL)",
 49    "Platform: Windows",
 50]
 51timestamp_override = "event.ingested"
 52type = "eql"
 53
 54query = '''
 55process where host.os.type == "windows" and event.type == "start" and
 56 process.name : ("rundll32.exe", "mshta.exe") and
 57  (
 58     (process.command_line :
 59        (
 60        "*script*eval(*",
 61         "*script*GetObject*",
 62         "*.regread(*",
 63         "*WScript.Shell*",
 64         "*.run(*",
 65         "*).Exec()*",
 66         "*mshta*http*",
 67         "*mshtml*RunHTMLApplication*",
 68         "*mshtml*,#135*",
 69         "*StrReverse*",
 70         "*.RegWrite*",
 71         /* Issue #379 */
 72         "*window.close(*",
 73         "* Chr(*"
 74         )
 75     and not ?process.parent.executable :
 76                  ("?:\\Program Files (x86)\\Citrix\\System32\\wfshell.exe",
 77                   "?:\\Program Files (x86)\\Microsoft Office\\Office*\\MSACCESS.EXE",
 78                   "?:\\Program Files\\Quokka.Works GTInstaller\\GTInstaller.exe")
 79     ) or
 80
 81    (process.name : "mshta.exe" and
 82     not process.command_line : ("*.hta*", "*.htm*", "-Embedding") and ?process.args_count >=2) or
 83
 84     /* Execution of HTA file downloaded from the internet */
 85     (process.name : "mshta.exe" and process.command_line : "*\\Users\\*\\Downloads\\*.hta*") or
 86
 87     /* Execution of HTA file from archive */
 88     (process.name : "mshta.exe" and
 89      process.args : ("?:\\Users\\*\\Temp\\7z*", "?:\\Users\\*\\Temp\\Rar$*", "?:\\Users\\*\\Temp\\Temp?_*", "?:\\Users\\*\\Temp\\BNZ.*"))
 90   )
 91'''
 92
 93note = """## Triage and analysis
 94
 95### Investigating Script Execution via Microsoft HTML Application
 96
 97#### Possible investigation steps
 98
 99- Which HTML-application proxy path did the alert capture?
100  - Why: proxy path determines the containment target.
101  - Focus: `process.name`, `process.command_line`, and `process.args_count`: ".hta", ".htm", "vbscript:", "javascript:", "GetObject("script:")", "mshtml,RunHTMLApplication", "mshtml,#135", "http", "WScript.Shell", "StrReverse", "window.close(", or "Chr(".
102  - Implication: escalate on inline script, remote retrieval, obfuscation, "RunHTMLApplication", archive/temp execution, or non-HTA "mshta.exe"; lower concern only for one stable internal HTA/HTM path with no inline script, remote locator, or obfuscation.
103
104- Is the proxy binary a genuine Microsoft LOLBin or a masqueraded executable?
105  - Focus: `process.executable`, `process.pe.original_file_name`, `process.hash.sha256`, `process.code_signature.subject_name`, and `process.code_signature.trusted`.
106  - Implication: escalate when "mshta.exe" or "rundll32.exe" runs from a user-writable or non-Windows path, has a mismatched original filename, or lacks a trusted Microsoft signature; canonical Microsoft identity lowers masquerade risk but does not clear suspicious arguments.
107
108- What parent and user context explain the launch?
109  - Focus: `process.parent.executable`, `process.parent.command_line`, `user.id`, and `host.id`.
110  - Implication: escalate when the parent is Office, a browser, archive utility, script host, user-writable executable, or a chain outside the rule's excluded parents; lower concern when the same parent, user cohort, and host cohort repeatedly launch the same recognized HTA workflow.
111
112- What referenced HTA, scriptlet, URL, or path can be recovered?
113  - Focus: `process.command_line`, `process.args`, and `process.working_directory`: literal HTA/HTM path, scriptlet URL, remote locator, archive/temp marker, or relative path; recover same-process file and network/DNS events when artifact or remote locator evidence exists. $investigate_0 $investigate_1
114  - Implication: escalate when the locator points to Downloads, Temp, archive extraction, external URLs, scriptlet retrieval, alternate data stream-like syntax, or a single-user path; lower concern only for the same stable internal path from the same recognized workflow. Missing file, network, or DNS telemetry is unresolved, not benign.
115
116- Did the proxy spawn follow-on code or payload execution?
117  - Focus: child starts on `host.id` where `process.parent.entity_id` equals alert `process.entity_id`; inspect child `process.executable`, `process.command_line`, `process.pe.original_file_name`, `process.code_signature.subject_name`, and `process.code_signature.trusted`. $investigate_2
118  - Hint: if `process.entity_id` is absent, use `host.id` + `process.pid` + the tight alert window as a weaker fallback; treat PID reuse as unresolved ambiguity.
119  - Implication: escalate when the proxy spawns shells, PowerShell, script hosts, "regsvr32.exe", another "rundll32.exe", unsigned payloads, or tooling unrelated to the parent workflow; lower concern when child activity stays within the same recognized signed application flow.
120
121- If evidence remains suspicious or incomplete, is it isolated?
122  - Focus: `user.id`, `host.id`, stable `process.command_line` fragments, child `process.executable`, and child `process.command_line` recovered above. $investigate_3 $investigate_4
123  - Implication: broaden scope when the same user, host, command fragment, or child process repeats across alerts or other hosts; keep scope local only when isolated and aligned with one recognized workflow.
124
125- Escalate on proxy script execution, masquerade, suspicious lineage, external/temporary sourcing, follow-on payloads, or recurrence; close only when command intent, binary identity, lineage, locator, child behavior, and scope align with one recognized internal HTA/HTM workflow; preserve artifacts and escalate when evidence is mixed or incomplete.
126
127### False positive analysis
128
129- Legacy internal HTA applications or support tools may use "mshta.exe" when identity, intent, and context align: canonical Microsoft `process.executable`, stable `process.parent.executable`, repeated `process.command_line` for one internal HTA/HTM path, consistent `user.id`/`host.id` cohort, and no child branching into shells or script hosts. If inventory, owner, or change records exist, require alignment with this telemetry; otherwise require recurrence of the same stable process pattern across prior alerts from this rule for the same cohort.
130- Vendor installers or deployment tools can trigger archive/temp HTA patterns when parent executable, signer context, command line, and bounded child chain match the same recognized package workflow. Do not close on parent name alone; contradictory locator, child process, user/host scope, or signer evidence stays suspicious. Exceptions should use the minimum confirmed pattern, such as `process.parent.executable` + stable `process.command_line` fragment + `host.id` or `user.id`, not `process.name`.
131
132### Response and remediation
133
134- If confirmed benign:
135  - Reverse temporary containment and record the parent workflow, `process.command_line`, extracted locator/path, `user.id`, `host.id`, and recurrence or business records that confirmed the recognized application path. Build exceptions only from the minimum stable workflow pattern, not from "mshta.exe" or "rundll32.exe" alone.
136- If suspicious but unconfirmed:
137  - Preserve the alert event export, process tree, `process.entity_id`, `process.pid`, `process.command_line`, `process.args`, parent lineage, user/host context, recovered child process events, and literal URLs or paths extracted from the command line before cleanup.
138  - Apply reversible containment tied to the findings, such as temporary destination restrictions for remote locators, child-process blocking, or heightened monitoring on the affected `host.id` and `user.id`; use host isolation only when child-process or staging evidence indicates active payload execution and host criticality permits it.
139- If confirmed malicious:
140  - Isolate the host or contain the affected identity after preserving the process and child-process evidence that established malicious execution. Terminate the proxy and spawned payload processes only after recording their identifiers and command lines.
141  - Block confirmed malicious command-line locators, child binaries, domains, and addresses identified during triage, then review other hosts and users for the same command fragment or child-process pattern before eradication.
142  - Remove the malicious HTA, scriptlet, archive-extracted payload, or staged child artifacts identified during investigation; remediate the parent document, browser, archive, or script delivery path; investigate credential exposure if follow-on behavior suggests collection or lateral movement.
143- Post-incident hardening:
144  - Restrict or monitor "mshta.exe" and unusual "rundll32.exe" script-execution paths where the business does not require them.
145  - Retain process telemetry for these binaries and record any missing artifact, library, or destination visibility that limited the case so future triage can account for the gap.
146"""
147
148setup = """## Setup
149
150This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
151
152Setup instructions: https://ela.st/install-elastic-defend
153
154### Additional data sources
155
156This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
157
158- [CrowdStrike](https://ela.st/crowdstrike-integration)
159- [Microsoft Defender XDR](https://ela.st/m365-defender)
160- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
161- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
162- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
163"""
164
165[rule.investigation_fields]
166field_names = [
167    "@timestamp",
168    "host.name",
169    "host.id",
170    "user.name",
171    "user.id",
172    "process.entity_id",
173    "process.code_signature.subject_name",
174    "process.executable",
175    "process.command_line",
176    "process.args",
177    "process.pe.original_file_name",
178    "process.code_signature.trusted",
179    "process.parent.entity_id",
180    "process.parent.executable",
181    "process.parent.command_line",
182]
183
184[transform]
185
186[[transform.investigate]]
187label = "File events for the same proxy instance"
188description = ""
189providers = [
190  [
191    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
192    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
193    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
194  ]
195]
196relativeFrom = "now-1h"
197relativeTo = "now"
198
199[[transform.investigate]]
200label = "Network and DNS events for the same proxy instance"
201description = ""
202providers = [
203  [
204    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" },
205    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
206    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
207  ],
208  [
209    { excluded = false, field = "event.category", queryType = "phrase", value = "dns", valueType = "string" },
210    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
211    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
212  ]
213]
214relativeFrom = "now-1h"
215relativeTo = "now"
216
217[[transform.investigate]]
218label = "Child process events for the same proxy instance"
219description = ""
220providers = [
221  [
222    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
223    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
224    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
225  ]
226]
227relativeFrom = "now-1h"
228relativeTo = "now"
229
230[[transform.investigate]]
231label = "Alerts associated with the user"
232description = ""
233providers = [
234  [
235    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
236    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
237  ]
238]
239relativeFrom = "now-48h/h"
240relativeTo = "now"
241
242[[transform.investigate]]
243label = "Alerts associated with the host"
244description = ""
245providers = [
246  [
247    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
248    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
249  ]
250]
251relativeFrom = "now-48h/h"
252relativeTo = "now"
253
254[[rule.threat]]
255framework = "MITRE ATT&CK"
256
257[[rule.threat.technique]]
258id = "T1218"
259name = "System Binary Proxy Execution"
260reference = "https://attack.mitre.org/techniques/T1218/"
261
262[[rule.threat.technique.subtechnique]]
263id = "T1218.005"
264name = "Mshta"
265reference = "https://attack.mitre.org/techniques/T1218/005/"
266
267[[rule.threat.technique.subtechnique]]
268id = "T1218.011"
269name = "Rundll32"
270reference = "https://attack.mitre.org/techniques/T1218/011/"
271
272[rule.threat.tactic]
273id = "TA0005"
274name = "Defense Evasion"
275reference = "https://attack.mitre.org/tactics/TA0005/"
276
277[[rule.threat]]
278framework = "MITRE ATT&CK"
279
280[[rule.threat.technique]]
281id = "T1059"
282name = "Command and Scripting Interpreter"
283reference = "https://attack.mitre.org/techniques/T1059/"
284
285[[rule.threat.technique.subtechnique]]
286id = "T1059.005"
287name = "Visual Basic"
288reference = "https://attack.mitre.org/techniques/T1059/005/"
289
290[[rule.threat.technique.subtechnique]]
291id = "T1059.007"
292name = "JavaScript"
293reference = "https://attack.mitre.org/techniques/T1059/007/"
294
295[rule.threat.tactic]
296id = "TA0002"
297name = "Execution"
298reference = "https://attack.mitre.org/tactics/TA0002/"