Threat video1:00
Cobalt Strike HTA Downloader via VBS: Detection & IOCs
A Cobalt Strike HTA downloader hides its stage in double URL encoding and Base64; 9 detection rules, 10 IOCs and a free Splunk SPL rule cover it.
Read the full threat intel for Cobalt Strike HTA Downloader via VBS: Detection & IOCs →
Chapters
- 0:00The hook3 layers hide Cobalt Strike downloader.
- 0:04The storyEmbee analyzed an obfuscated HTA sample.
- 0:11Attack pathHTA file runs via mshta triggering decode.
- 0:27AttributionNo threat actor is attributed.
- 0:31Indicators of compromise7 indicators to hunt: 1 IP, 1 URL and 1 SHA-256 hash, and more.
- 0:39MITRE ATT&CK techniques7 ATT&CK techniques, from execution to command and control.
- 0:44Remediation3 steps now: Block outbound connections.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:003 layers hide Cobalt Strike downloader.
0:05Embee analyzed an obfuscated HTA sample.
0:08Inside: Cobalt Strike downloader.
0:11HTA file runs via mshta triggering decode.
0:15Double URL encoding, Base64, whitespace layers.
0:19VBScript downloader runs, function hidden.
0:22It fetches the second stage over HTTP.
0:27No threat actor is attributed. Confidence: low.
0:317 indicators to hunt: 1 IP, 1 URL and 1 SHA-256 hash, and more.
0:407 ATT&CK techniques, from execution to command and control.
0:443 steps now: Block outbound connections.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.