Invoke-Obfuscation Via Use MSHTA - PowerShell
Detects Obfuscated Powershell via use MSHTA in Scripts
Sigma rule (View on GitHub)
1title: Invoke-Obfuscation Via Use MSHTA - PowerShell
2id: e55a5195-4724-480e-a77e-3ebe64bd3759
3status: test
4description: Detects Obfuscated Powershell via use MSHTA in Scripts
5references:
6 - https://github.com/SigmaHQ/sigma/issues/1009 # (Task31)
7author: Nikita Nazarov, oscd.community
8date: 2020/10/08
9modified: 2022/11/29
10tags:
11 - attack.defense_evasion
12 - attack.t1027
13 - attack.execution
14 - attack.t1059.001
15logsource:
16 product: windows
17 category: ps_script
18 definition: 'Requirements: Script Block Logging must be enabled'
19detection:
20 selection_4104:
21 ScriptBlockText|contains|all:
22 - 'set'
23 - '&&'
24 - 'mshta'
25 - 'vbscript:createobject'
26 - '.run'
27 - '(window.close)'
28 condition: selection_4104
29falsepositives:
30 - Unknown
31level: high
References
Related rules
- ConvertTo-SecureString Cmdlet Usage Via CommandLine
- Invoke-Obfuscation CLIP+ Launcher - Security
- Invoke-Obfuscation COMPRESS OBFUSCATION
- Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell
- Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module