attack.t1218.005

HackTool - CACTUSTORCH Remote Thread Creation

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.execution attack.t1055.012 attack.t1059.005 attack.t1059.007 attack.t1218.005 ·

Share on:

Detects remote thread creation from CACTUSTORCH as described in references.

MSHTA Execution with Suspicious File Extensions

Jun 11, 2025 · attack.defense-evasion attack.t1140 attack.t1218.005 attack.execution attack.t1059.007 cve.2020-1599 ·

Share on:

Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content, such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.

Csc.EXE Execution Form Potentially Suspicious Parent

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 attack.defense-evasion attack.t1218.005 attack.t1027.004 ·

Share on:

Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.

Potential Baby Shark Malware Activity

Aug 12, 2024 · attack.execution attack.defense-evasion attack.discovery attack.t1012 attack.t1059.003 attack.t1059.001 attack.t1218.005 detection.emerging-threats ·

Share on:

Detects activity that could be related to Baby Shark malware

Potential LethalHTA Technique Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218.005 ·

Share on:

Detects potential LethalHTA technique where the "mshta.exe" is spawned by an "svchost.exe" process

Remotely Hosted HTA File Executed Via Mshta.EXE

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.005 ·

Share on:

Detects execution of the "mshta" utility with an argument containing the "http" keyword, which could indicate that an attacker is executing a remotely hosted malicious hta file

Suspicious JavaScript Execution Via Mshta.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.005 ·

Share on:

Detects execution of javascript code using "mshta.exe".

Suspicious MSHTA Child Process

Aug 12, 2024 · attack.defense-evasion attack.t1218.005 car.2013-02-003 car.2013-03-001 car.2014-04-003 ·

Share on:

Detects a suspicious process spawning from an "mshta.exe" process, which could be indicative of a malicious HTA script execution