BIOC Informational

Microsoft HTML Application Host spawns from Explorer.exe

Mshta allows execution of .hta files, an attacker can use mshta to execute malicious hta files on the victim's host.

Module:
Platform Analytics
Agent event type:
Process execution
Category:
Evasion
Status:
Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: System Binary Proxy Execution: Compiled HTML File (T1218.001)
Indicator:

Process action type = execution AND target process name = mshta.exe Process initiated by = explorer.exe , cgo name = explorer.exe , os parent name = explorer.exe Host host os = windows

Preventable: yes