Suspicious Execution via Mshtml.dll RunHTMLApplication

This threat involves the abuse of the mshtml.dll library on Windows systems, specifically leveraging the RunHTMLApplication export. By invoking this export through rundll32.exe, attackers can bypass security controls and execute arbitrary scripts or code embedded in remote or local HTML files. This technique supports multiple protocol handlers, including vbscript, javascript, file, and http, allowing for versatile payload delivery. Defenders should monitor for command-line arguments that reference mshtml and the RunHTMLApplication export, as these are rarely used in legitimate administrative or application activity. This method has been documented as a technique for security product evasion and malware execution, often serving as an initial access or persistence mechanism.

Impact

Successful exploitation allows for arbitrary code execution with the privileges of the user running the command, potentially leading to system compromise, data exfiltration, or deployment of secondary malware. While not linked to a specific campaign, the technique is a known mechanism for bypassing traditional signature-based detections and security product mitigations.

Recommendation

Deploy the provided Sigma rule to identify command-line activity indicative of this technique. Enable command-line logging (Sysmon Event ID 1 or Windows Event ID 4688) across the environment to capture full execution paths and command arguments. Monitor for suspicious parent processes attempting to spawn rundll32.exe with these specific command-line arguments.