Cortex XDR
#Scenario
Detect stealthy living-off-the-land techniques where the built-in Microsoft HTML Application host is weaponised to bypass your endpoint application control policies.
markdown
> Make sure you're comfortable with the results in your own environment before using this more widely.
# Snippet -
## Mshta fetching a remote HTA
Scenario: imagine an environment where a phishing lure persuades a user to
open a link that ultimately invokes `mshta.exe` against a remote `.hta` file.
HTAs run with full Windows scripting capability and remain a steady choice
for initial access through 2025-2026.
Logic: any `mshta.exe` invocation with an HTTP URL or an inline script URI is high-signal. Pair the parent process and user with the destination host in `action_external_hostname` for follow-up.
- [https://attack.mitre.org/techniques/T1218/005/](https://attack.mitre.org/techniques/T1218/005/)
- [https://lolbas-project.github.io/lolbas/Binaries/Mshta/](https://lolbas-project.github.io/lolbas/Binaries/Mshta/)xql
// Make sure you're comfortable with the results in your own environment before using this more widely.
dataset = xdr_data
| filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter lowercase(action_process_image_name) = "mshta.exe"
| filter lowercase(action_process_image_command_line) contains "http"
or lowercase(action_process_image_command_line) contains "javascript:"
or lowercase(action_process_image_command_line) contains "vbscript:"
| fields _time, agent_hostname, actor_effective_username,
causality_actor_process_image_name, action_process_image_command_line
| limit 200