mitre att&ck technique
T1218.005
Mshta
3 posts cover this technique
-
T1218.005 - msxsl + typeperf Execution - EDR Detection (PowerQuery)
PowerQuery-based EDR detection for LOLBin abuse via msxsl.exe and typeperf.exe process creation from non-standard paths.
-
T1218.005 - msxsl / typeperf Execution Response Playbook
Incident response playbook for containing and eradicating LOLBin abuse via msxsl.exe and typeperf.exe, including containment, credential reset, and post-incident detection steps.
-
T1218.005 - msxsl Abuse - Host Recovery & Mitigation Plan
Remediation steps for cleaning up msxsl.exe and more_eggs persistence, including registry cleanup, file removal, and credential reset procedures.