Incoming DCOM Lateral Movement via MSHTA

  1[metadata]
  2creation_date = "2020/11/03"
  3integration = ["endpoint", "windows"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the use of Distributed Component Object Model (DCOM) to execute commands from a remote host, which are
 11launched via the HTA Application COM Object. This behavior may indicate an attacker abusing a DCOM application to move
 12laterally while attempting to evade detection.
 13"""
 14from = "now-9m"
 15index = [
 16    "winlogbeat-*",
 17    "logs-endpoint.events.process-*",
 18    "logs-endpoint.events.network-*",
 19    "logs-windows.sysmon_operational-*",
 20]
 21language = "eql"
 22license = "Elastic License v2"
 23name = "Incoming DCOM Lateral Movement via MSHTA"
 24references = ["https://code-white.com/blog/2018-07-lethalhta/"]
 25risk_score = 73
 26rule_id = "622ecb68-fa81-4601-90b5-f8cd661e4520"
 27severity = "high"
 28tags = [
 29    "Domain: Endpoint",
 30    "OS: Windows",
 31    "Use Case: Threat Detection",
 32    "Tactic: Lateral Movement",
 33    "Data Source: Elastic Defend",
 34    "Data Source: Sysmon",
 35    "Resources: Investigation Guide",
 36    "Noise: Low",
 37    "Performance: Normal",
 38    "Profile: Recommended",
 39    "Threat: Living off the Land",
 40    "Rule Type: Event Correlation (EQL)",
 41    "Platform: Windows",
 42]
 43type = "eql"
 44
 45query = '''
 46sequence with maxspan=1m
 47  [process where host.os.type == "windows" and event.type == "start" and
 48     process.name : "mshta.exe" and process.args : "-Embedding"
 49  ] by host.id, process.entity_id
 50  [network where host.os.type == "windows" and event.type == "start" and process.name : "mshta.exe" and
 51     network.direction : ("incoming", "ingress") and network.transport == "tcp" and
 52     source.port > 49151 and destination.port > 49151 and source.ip != "127.0.0.1" and source.ip != "::1"
 53  ] by host.id, process.entity_id
 54'''
 55
 56note = """## Triage and analysis
 57
 58### Investigating Incoming DCOM Lateral Movement via MSHTA
 59
 60#### Investigation steps
 61
 62- Do recovered source events show remote COM activation of mshta on this host?
 63  - Focus: alert `host.id` and `process.entity_id`; recover `process.command_line` plus matching network `source.ip`, `source.port`, `destination.port`, and `network.direction`.
 64  - Implication: escalate when the COM-server process receives incoming non-loopback RPC-style TCP from an unconfirmed source; lower only when telemetry and exact confirmation tie source, target, and COM-server launch to recurring distribution or helpdesk activity. Missing source events leave the alert unresolved.
 65
 66- Is mshta the expected Windows COM server, not a staged or masqueraded copy?
 67  - Focus: `process.executable`, `process.hash.sha256`, `process.code_signature.subject_name`, `process.code_signature.trusted`, and `process.parent.executable`.
 68  - Implication: escalate when mshta runs from a user-writable or non-Windows path, has an unexpected signer, or lacks a service/DCOM-style parent such as "svchost.exe"; Microsoft identity lowers only masquerade risk because source and retrieval still decide the case.
 69
 70- Do source, account, and logon context support the same confirmed workflow?
 71  - Focus: recovered `source.ip`, target-side `user.id`, and session bridge `process.Ext.authentication_id`, `winlog.event_data.TargetLogonId`, and `winlog.event_data.AuthenticationPackageName`.
 72  - Implication: escalate when source, account, session type, or auth package conflict with the source-event workflow; lower only when telemetry and exact confirmation identify a legitimate source-to-host relationship. Missing Windows Security telemetry leaves origin and auth method unresolved, not benign.
 73
 74- Does same-process DNS/connection data show remote script retrieval?
 75  - Why: HTA COM can load remote script content into "mshta.exe"; same-process retrieval is direct corroboration.
 76  - Focus: same-process DNS `dns.question.name` and `dns.resolved_ip`, then connection `destination.ip` and `destination.port`. $investigate_0
 77  - Hint: map `dns.question.name` to `dns.resolved_ip` before tying later `destination.ip` to retrieval.
 78  - Implication: escalate when mshta resolves or connects to public, rare, or mismatched content hosts; lower only when the destination maps to the same recognized internal or vendor workflow as the source. Missing DNS or connection telemetry leaves retrieval unresolved, not benign.
 79
 80- Do file artifacts show cached HTA content or staged payloads?
 81  - Focus: same-host file events tied to `host.id` and mshta or follow-on `process.entity_id`, especially `file.path`, `file.origin_url`, `file.Ext.windows.zone_identifier`, and `file.Ext.original.path`. $investigate_1
 82  - Range: start with the alert window; expand after the first suspicious write to confirm later execution.
 83  - Implication: escalate when the chain writes HTA/script/payload content to temp, downloads, ADS-like, systemprofile "INetCache", or extensionless paths, or when the artifact later executes; lower when artifacts stay in one recurring deployment path. Missing file telemetry is unresolved, not benign.
 84
 85- Does mshta stay in-process or hand off execution?
 86  - Why: LethalHTA can run JScript/VBScript, DotNetToJScript, CLR, or beacon code inside "mshta.exe"; absence of child processes does not clear the alert.
 87  - Focus: child process starts from recovered mshta `process.entity_id`. $investigate_2
 88  - Library: same-process `dll.path`, `dll.code_signature.subject_name`, `dll.code_signature.trusted`, and `dll.Ext.relative_file_creation_time`. $investigate_3
 89  - Implication: escalate when mshta spawns shells, downloaders, proxy-execution utilities, or loads recent/untrusted libraries from writable or nonstandard paths; narrow only when no follow-on execution appears and earlier source, session, and retrieval fit one recognized workflow. Missing library telemetry leaves in-process payload review unresolved, not benign.
 90
 91- Do related alerts change scope?
 92  - Focus: related lateral-movement, proxy-execution, or follow-on delivery alerts for `host.id` in the prior 48h. $investigate_4
 93  - Hint: use the host-scoped transform first; search recovered `source.ip`, `dns.question.name`, or `destination.ip` across other targets only if local evidence remains suspicious or unresolved.
 94  - Implication: escalate scope when the host shows adjacent lateral-movement, proxy-execution, or follow-on delivery alerts, or when the source touches additional targets; keep the case local when the alert is isolated and earlier evidence fits one stable workflow.
 95
 96- Escalate unauthorized DCOM HTA execution when source-event chain, source/session fit, retrieval, artifacts/libraries, child execution, or related-alert scope remain suspicious; close only when pivots bind one recognized host workflow without contradictory retrieval, artifact, or follow-on activity; if answers stay mixed or incomplete, preserve evidence and escalate.
 97
 98### False positive analysis
 99
100- Management tooling (software distribution, enrollment, or helpdesk launchers) can legitimately activate the HTA COM object. Confirm `source.ip` is the management host, mshta identity and `process.parent.executable` match that tool, DNS/destination pattern serves it, and artifacts, children, or libraries do not contradict it. Telemetry that cannot prove legitimacy needs change, distribution, asset, or owner confirmation.
101- Do not close on partial context: known admin subnet, Microsoft-signed "mshta.exe", or familiar user alone. If any evidence dimension contradicts the expected workflow, or neither telemetry nor exact confirmation proves it, treat the alert as suspicious or unresolved.
102- Anchor exceptions on the minimum confirmed workflow: recognized `source.ip`, stable `process.parent.executable`, recovered `process.command_line`, specific benign `dns.question.name` or `destination.ip`, and relevant `host.id`. Avoid exceptions on `process.name` of "mshta.exe", incoming high ports, or `user.name` alone.
103
104### Response and remediation
105
106- If confirmed benign, reverse temporary containment and document source, target host, mshta identity, parent context, destination pattern, and artifact evidence confirming the recognized workflow. Create an exception only for the exact pattern confirmed by telemetry and supporting records or owner confirmation.
107- If suspicious but unconfirmed, preserve Timeline source events, mshta identity and command line, remote source and high-port pair, DNS and destination evidence, cached/staged files, child processes, suspicious libraries, and relevant case exports before containment or cleanup.
108- Apply reversible containment first: restrict DCOM or web retrieval between the target and recovered source/destination, increase monitoring on `host.id` and `user.id`, or isolate the endpoint only when retrieval, child execution, or library evidence indicates active payload execution and the host role permits isolation.
109- If confirmed malicious, isolate the target endpoint and contain the recovered source system or account when in scope. Block malicious domains, destinations, and hashes; record process and artifact IDs before killing processes or deleting files.
110- Scope other hosts reached by the same recovered `source.ip`, `dns.question.name`, `destination.ip`, or `process.command_line` pattern before destructive eradication, credential removal, or broad DCOM changes.
111- Eradicate only identified HTA, HTML, script, DLL, cached content, or staged payloads, then remediate the DCOM exposure, application workflow, or credentials that enabled remote execution.
112- Post-incident hardening: restrict DCOM exposure to recognized management paths, keep Windows Firewall or equivalent RPC controls enabled for the host class, limit HTA use to recognized workflows, retain process/network/file/library telemetry, and record SMB/named-pipe delivery if found during scoping.
113"""
114
115setup = """## Setup
116
117This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
118
119Setup instructions: https://ela.st/install-elastic-defend
120
121### Additional data sources
122
123This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
124
125- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
126- [Sysmon Event ID 3 - Network Connection](https://ela.st/sysmon-event-3-setup)
127"""
128
129[rule.investigation_fields]
130field_names = [
131    "@timestamp",
132    "host.id",
133    "process.entity_id",
134]
135
136[transform]
137
138[[transform.investigate]]
139label = "Network events for the mshta process"
140description = ""
141providers = [
142  [
143    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" },
144    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
145    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
146  ]
147]
148relativeFrom = "now-1h"
149relativeTo = "now"
150
151[[transform.investigate]]
152label = "File events for the mshta process"
153description = ""
154providers = [
155  [
156    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
157    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
158    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
159  ]
160]
161relativeFrom = "now-1h"
162relativeTo = "now"
163
164[[transform.investigate]]
165label = "Child process starts from the mshta process"
166description = ""
167providers = [
168  [
169    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
170    { excluded = false, field = "event.type", queryType = "phrase", value = "start", valueType = "string" },
171    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
172    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
173  ]
174]
175relativeFrom = "now-1h"
176relativeTo = "now"
177
178[[transform.investigate]]
179label = "Library events for the mshta process"
180description = ""
181providers = [
182  [
183    { excluded = false, field = "event.category", queryType = "phrase", value = "library", valueType = "string" },
184    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
185    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
186  ]
187]
188relativeFrom = "now-1h"
189relativeTo = "now"
190
191[[transform.investigate]]
192label = "Alerts associated with the host"
193description = ""
194providers = [
195  [
196    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
197    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
198  ]
199]
200relativeFrom = "now-48h/h"
201relativeTo = "now"
202
203[[rule.threat]]
204framework = "MITRE ATT&CK"
205
206[[rule.threat.technique]]
207id = "T1021"
208name = "Remote Services"
209reference = "https://attack.mitre.org/techniques/T1021/"
210
211[[rule.threat.technique.subtechnique]]
212id = "T1021.003"
213name = "Distributed Component Object Model"
214reference = "https://attack.mitre.org/techniques/T1021/003/"
215
216[rule.threat.tactic]
217id = "TA0008"
218name = "Lateral Movement"
219reference = "https://attack.mitre.org/tactics/TA0008/"
220
221[[rule.threat]]
222framework = "MITRE ATT&CK"
223
224[[rule.threat.technique]]
225id = "T1218"
226name = "System Binary Proxy Execution"
227reference = "https://attack.mitre.org/techniques/T1218/"
228
229[[rule.threat.technique.subtechnique]]
230id = "T1218.005"
231name = "Mshta"
232reference = "https://attack.mitre.org/techniques/T1218/005/"
233
234[rule.threat.tactic]
235id = "TA0005"
236name = "Defense Evasion"
237reference = "https://attack.mitre.org/tactics/TA0005/"
238
239[[rule.threat]]
240framework = "MITRE ATT&CK"
241
242[[rule.threat.technique]]
243id = "T1559"
244name = "Inter-Process Communication"
245reference = "https://attack.mitre.org/techniques/T1559/"
246
247[[rule.threat.technique.subtechnique]]
248id = "T1559.001"
249name = "Component Object Model"
250reference = "https://attack.mitre.org/techniques/T1559/001/"
251
252[rule.threat.tactic]
253id = "TA0002"
254name = "Execution"
255reference = "https://attack.mitre.org/tactics/TA0002/"