Renamed MSHTA launching html
Renamed MSHTA launching html
Sigma rule (View on GitHub)
1title: Renamed MSHTA launching html
2status: experimental
3description: Renamed MSHTA launching html
4author: Joe Security
5date: 2020-08-20
6id: 200085
7threatname:
8behaviorgroup: 5
9classification: 8
10mitreattack:
11
12logsource:
13 category: process_creation
14 product: windows
15detection:
16 selection:
17 CommandLine:
18 - '*\public\\*.com *\\*.html*'
19
20 condition: selection
21level: critical