CVE-2024-43461

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "mshta.exe" or InitiatingProcessFileName =~ "iexplore.exe" or InitiatingProcessFileName =~ "edge.exe" // Or other browsers that might use MSHTML
| where ProcessCommandLine contains "http" or ProcessCommandLine contains "https"
| where FileName =~ "powershell.exe" or FileName =~ "cmd.exe" or FileName =~ "wscript.exe" or FileName =~ "cscript.exe" // Look for suspicious child processes
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, FileName, FolderPath, SHA256

Splunk SPL

index=windows (ParentProcessName="mshta.exe" OR ParentProcessName="iexplore.exe" OR ParentProcessName="edge.exe") (ProcessName="powershell.exe" OR ProcessName="cmd.exe" OR ProcessName="wscript.exe" OR ProcessName="cscript.exe")
| table _time, host, ParentProcessName, CommandLine, ProcessName, Image, sha256

Sigma

title: MSHTML Spoofing Related Activity
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\mshta.exe'
      - '\iexplore.exe'
      - '\edge.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate browser/MSHTA usage followed by script execution (requires tuning)
level: high

Elastic ES|QL

from process where event.category == "process" and event.type == "start" and (process.parent.executable.keyword : ("mshta.exe", "iexplore.exe", "edge.exe")) and (process.executable.keyword : ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe"))
| project @timestamp, host.name, process.parent.executable, process.command_line, process.executable, process.hash.sha256