Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionhightest

Mshtml.DLL RunHTMLApplication Suspicious Usage

Detects execution of commands that leverage the "mshtml.dll" RunHTMLApplication export to run arbitrary code via different protocol handlers (vbscript, javascript, file, http...)

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems), Josh Nickels, François Hubaut, Zaw Min Htun (ZETA)Created Sun Aug 14Updated Fri Feb 234782eb5a-a513-4523-a0ac-f3082b26ac5cwindows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        CommandLine|contains|all:
            - '\..\'
            - 'mshtml'
        CommandLine|contains:
            - '#135'
            - 'RunHTMLApplication'
    condition: selection
False Positives
Unlikely

False positives are unlikely for most environments. High confidence detection.

References
1
Resolving title…
twitter.com
2
Resolving title…
hyp3rlinx.altervista.org
3
Resolving title…
hyp3rlinx.altervista.org
MITRE ATT&CK
Related Rules
Similar

9f06447a-a33a-4cbe-a94f-a3f43184a7a3

Rule not found
Similar

73fcad2e-ff14-4c38-b11d-4172c8ac86c7

Rule not found
Rule Metadata
Rule ID
4782eb5a-a513-4523-a0ac-f3082b26ac5c
Status
test
Level
high
Type
Detection
Created
Sun Aug 14
Modified
Fri Feb 23
Author
Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems), Josh Nickels, François Hubaut, Zaw Min Htun (ZETA)
Path
rules/windows/process_creation/proc_creation_win_rundll32_mshtml_runhtmlapplication.yml
Raw Tags
attack.defense-evasionattack.execution
View on GitHub