ClickFix mshta DNS Query to External Domain
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects DNS queries initiated by mshta.exe to external domains -- indicates HTA-based payload resolving C2 or download domains. Excludes internal domains and private IP ranges.
Severity
Attention
Rule Requirement
Criteria
Action1:
actionname = "DNS Query Executed" AND ( PROCESSNAME endswith "\mshta.exe" AND QUERY notcontains "localhost,.local,.internal,.corp,.lan,.home,wpad,isatap,_ldap,_tcp,_udp,_msdcs" AND QUERY notcontains "10.,192.168.,172.16.,172.17.,172.18.,172.19.,172.20.,172.21.,172.22.,172.23.,172.24.,172.25.,172.26.,172.27.,172.28.,172.29.,172.30.,172.31.,127.,169.254.,::1,0:0:0:0:0:0:0:1,fe80:,fc,fd" )
select Action1.HOSTNAME,Action1.MESSAGE,Action1.PROCESSNAME,Action1.QUERY,Action1.STATUSCODE,Action1.RESULT
Detection
Execution Mode
realtime
Log Sources
Windows
