Hub configuration

Name: Mshtml.DLL RunHTMLApplication Suspicious Usage
Author: sigmahq

More info

Mshtml.DLL RunHTMLApplication Suspicious Usage Detection Scenario by sigmahq | CrowdSec Hub

« Mshtml.DLL RunHTMLApplication Suspicious Usage »
v0.2 by sigmahq / proc_creation_win_rundll32_mshtml_runhtmlapplication
Attack scenariowindowsNot spoofableLow confidence

Detects execution of commands that leverage the "mshtml.dll" RunHTMLApplication export to run arbitrary code via different protocol handlers (vbscript, javascript, file, http...)

Installation

cscli scenarios install sigmahq/proc_creation_win_rundll32_mshtml_runhtmlapplication

YAML Configuration

1type: trigger
2name: sigmahq/proc_creation_win_rundll32_mshtml_runhtmlapplication
3description: |
4  Detects execution of commands that leverage the "mshtml.dll" RunHTMLApplication export to run arbitrary code via different protocol handlers (vbscript, javascript, file, http...) 
5filter: |
6  (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.CommandLine contains '\\..\\' && evt.Parsed.CommandLine contains 'mshtml' && (evt.Parsed.CommandLine contains '#135' || evt.Parsed.CommandLine contains 'RunHTMLApplication'))
7blackhole: 2m
8#status: test
9labels:
10  service: windows
11  confidence: 1
12  spoofable: 0
13  classification:
14
15  label: "Mshtml.DLL RunHTMLApplication Suspicious Usage"
16  behavior : "windows:audit"
17  remediation: false
18
19scope:
20  type: ParentProcessId
21  expression: evt.Parsed.ParentProcessId
22
23

Hub configuration

« Mshtml.DLL RunHTMLApplication Suspicious Usage »v0.2 by sigmahq / proc_creation_win_rundll32_mshtml_runhtmlapplicationAttack scenariowindowsNot spoofableLow confidence

« Mshtml.DLL RunHTMLApplication Suspicious Usage »
v0.2 by sigmahq / proc_creation_win_rundll32_mshtml_runhtmlapplication
Attack scenariowindowsNot spoofableLow confidence