Build software better, together

A detection engineering repository simulating a real ransomware intrusion using Sysmon logs and Sigma rules. Includes coverage for mshta execution, netcat reverse shells, PowerShell enumeration, service modification, RunOnce registry persistence, data exfiltration, and encryption activity.

curl powershell ransomware sysmon case-study certutil sigma-rules mshta netcat-reverse-shell

Updated Jan 9, 2026

Modern-IE / IE-Engine-Bridge

Star

A lightweight C-based utility to launch a standalone Internet Explorer-powered browser interface via HTA, bypassing Microsoft Edge redirection on modern Windows 10/11.

hta internet-explorer c-language mshta windows-utility

Updated Apr 9, 2026
C

seb1k / block-mshta-with-intune

Star

Block outbound connections from mshta.exe using Microsoft Intune Firewall Rules

hardening intune windows-firewall microsoft-intune mitre-attack secure-score endpoint-security windows-security lolbas mshta microsoft-security

Updated May 27, 2026

OsmanDhaqane / living-off-the-land-attacks-tryhackme

Star

TryHackMe walkthrough focused on detecting Living Off the Land activity using trusted Windows tools, SIEM alerts, and command-line analysis.

powershell incident-response scheduled-tasks dfir cybersecurity siem soc wmic blue-team rundll32 certutil threat-detection lolbins living-off-the-land windows-security tryhackme mshta

Updated Apr 29, 2026

yev-cyber / dfir-malware-investigation

Star

Sanitized DFIR case study of a fake CAPTCHA malware delivery chain involving mshta, obfuscated PowerShell, LOTL behavior, IOC analysis, and remediation actions.

ioc powershell incident-response dfir cybersecurity threat-hunting malware-analysis digital-forensics investigation mshta lotl infostealers

Updated May 25, 2026

malcorex / Real-World-Malware-Analysis

Star

Technical analysis of a real-world HTA downloader sample, including behavioral analysis, execution flow, IoCs, detection opportunities, and defensive recommendations.

windows ioc reverse-engineering malware cybersecurity malware-analysis hta malware-research vbscript soc malware-samples real-world malware-detection malware-analysiss mshta analysis-malware

Updated Jul 31, 2026
HTML

mercwar / dc2url

Star

dc2url uses windows api handles for HTTP requests to go along with other popular programs like curl, powershell, bitsadmin, certutil, python, wget, node, cscript, mshta to provide access to private hosting addresses and unlike the others. This is because the JavaScript enabled headless processes requests using the Microsoft Windows WebView2 handle.

python git windows http json node tools command line curl powershell internet ftp wget cscript certutil mshta bitsadmin

Updated Nov 2, 2026
Batchfile

Navigation Menu

mshta

Here are 15 public repositories matching this topic...

gnh1201 / welsonjs

ildar-shaimordanov / my-scripts

AHMUJia / claude-chatmap

datadiode / cehta

otnc / captcha-like-fake-captcha

gnh1201 / yaww

akuafif / HTA-Map-Network-Printer

Rednexie / RSPG

Tam-George10 / Ransomware-Detection-Engineering

Modern-IE / IE-Engine-Bridge

seb1k / block-mshta-with-intune

OsmanDhaqane / living-off-the-land-attacks-tryhackme

yev-cyber / dfir-malware-investigation

malcorex / Real-World-Malware-Analysis

mercwar / dc2url

Add this topic to your repo