BIOC
Informational
✕
Microsoft HTML Application Host spawns from CMD or PowerShell
Microsoft HTML Application Host is a program whose source code consists of HTML, Dynamic HTML and a few scripting languages compatible with Internet Explorer such as VBScript or JScript. It does not typically spawn from PowerShell or CMD.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Execution
- Status:
- Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: System Binary Proxy Execution: Mshta (T1218.005)
Indicator:
Process action type = execution AND target process name = mshta.exe Process initiated by = cmd.exe , powershell.exe
Preventable: yes