feat(phase-32): add automated tests V3 for data sources, scoring, campaigns and snapshots (T-235 to T-237)

This commit is contained in:
2026-02-10 09:07:43 +01:00
parent 02034d60f0
commit 35983de67e
11 changed files with 1676 additions and 12 deletions

View File

@@ -0,0 +1,26 @@
Name: Mshta.exe
Description: Used to execute .HTA files
Author: Test Author
Created: 2025-01-15
Commands:
- Command: mshta.exe evilfile.hta
Description: Open an HTA file from disk
Usecase: Execute arbitrary HTA scripts
Category: Execute
Privileges: User
MitreID: T1218.005
OperatingSystem: Windows 10, Windows 11
- Command: mshta.exe vbscript:Execute("CreateObject(""Wscript.Shell"").Run(""calc.exe"")")
Description: Execute VBScript via mshta
Usecase: Execute inline VBScript
Category: Execute
Privileges: User
MitreID: T1059.005
OperatingSystem: Windows 10, Windows 11
Full_Path:
- Path: C:\Windows\System32\mshta.exe
- Path: C:\Windows\SysWOW64\mshta.exe
Detection:
- Sigma: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mshta.yml
Resources:
- Link: https://lolbas-project.github.io/#/mshta