-
Notifications
You must be signed in to change notification settings - Fork 1
/
mshta.yaml
91 lines (91 loc) · 1.83 KB
/
mshta.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
---
title: T1170 - Mshta
tactic:
- TA0006
technique: T1170
techniquename: Mshta
description:
header:
name: T1170 - Mshta
colspan: 7
rows:
- Row1:
name: Tools
style:
- red: 230
- green: 159
- blue: 0
entries:
- mshta:
name: Mshta
attributes:
- colspan: 3
- rundll32:
name: Rundll32
attributes:
- colspan: 3
- Row2:
name: Protocol Handlers (Extensible)
style:
- red: 86
- green: 180
- blue: 233
entries:
- vbscript_mshta:
name: 'vbscript:'
attributes:
- colspan: 1
- javascript_mshta:
name: 'javascript:'
attributes:
- colspan: 1
- unknown_mshta:
name: '???:'
attributes:
- colspan: 1
- vbscript_rundll32:
name: 'vbscript:'
attributes:
- colspan: 1
- javascript_rundll32:
name: 'javascript:'
attributes:
- colspan: 1
- unknown_rundll32:
name: '???:'
attributes:
- colspan: 1
- Row3:
name: COM CLSID
style:
- red: 0
- green: 158
- blue: 115
entries:
- 3050F3B2-98B5-11CF-BB82-00AA00BDCE0B:
#yamllint disable-line rule:line-length
name: 3050F3B2-98B5-11CF-BB82-00AA00BDCE0B</br>Microsoft HTML Javascript Pluggable Protocol
attributes:
- colspan: 6
- Row4:
name: COM Server
style:
- red: 240
- green: 228
- blue: 66
entries:
- mshtml:
name: C:\Windows\System32\mshtml.dll
attributes:
- colspan: 6
- Row5:
name: COM API Function
style:
- red: 213
- green: 94
- blue: 0
entries:
- runhtmlapplication:
name: RunHTMLApplication
attributes:
- colspan: 6