attack.t1218.005 | Detection.FYI

Csc.EXE Execution Form Potentially Suspicious Parent

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 attack.defense-evasion attack.t1218.005 attack.t1027.004 ·
Share on:

Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.

Read More
HackTool - CACTUSTORCH Remote Thread Creation

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1055.012 attack.t1059.005 attack.t1059.007 attack.t1218.005 ·
Share on:

Detects remote thread creation from CACTUSTORCH as described in references.

Read More
MSHTA Suspicious Execution 01

Aug 12, 2024 · attack.defense-evasion attack.t1140 attack.t1218.005 attack.execution attack.t1059.007 cve.2020-1599 ·
Share on:

Detection for mshta.exe suspicious execution patterns sometimes involving file polyglotism

Read More
Potential Baby Shark Malware Activity

Aug 12, 2024 · attack.execution attack.defense-evasion attack.discovery attack.t1012 attack.t1059.003 attack.t1059.001 attack.t1218.005 detection.emerging-threats ·
Share on:

Detects activity that could be related to Baby Shark malware

Read More
Potential LethalHTA Technique Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218.005 ·
Share on:

Detects potential LethalHTA technique where the "mshta.exe" is spawned by an "svchost.exe" process

Read More
Remotely Hosted HTA File Executed Via Mshta.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.005 ·
Share on:

Detects execution of the "mshta" utility with an argument containing the "http" keyword, which could indicate that an attacker is executing a remotely hosted malicious hta file

Read More
Suspicious JavaScript Execution Via Mshta.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.005 ·
Share on:

Detects execution of javascript code using "mshta.exe".

Read More
Suspicious MSHTA Child Process

Aug 12, 2024 · attack.defense-evasion attack.t1218.005 car.2013-02-003 car.2013-03-001 car.2014-04-003 ·
Share on:

Detects a suspicious process spawning from an "mshta.exe" process, which could be indicative of a malicious HTA script execution

Read More
Mshta Executing from Registry

Jan 9, 2023 · attack.defense_evasion attack.t1218.005 ·
Share on:

Detects a Mshta executing code from the registry

Read More