Build software better, together

A detection engineering repository simulating a real ransomware intrusion using Sysmon logs and Sigma rules. Includes coverage for mshta execution, netcat reverse shells, PowerShell enumeration, service modification, RunOnce registry persistence, data exfiltration, and encryption activity.

curl powershell ransomware sysmon case-study certutil sigma-rules mshta netcat-reverse-shell

Updated Jan 9, 2026

Modern-IE / IE-Engine-Bridge

Star

A lightweight C-based utility to launch a standalone Internet Explorer-powered browser interface via HTA, bypassing Microsoft Edge redirection on modern Windows 10/11.

hta internet-explorer c-language mshta windows-utility

Updated Apr 9, 2026
C

seb1k / block-mshta-with-intune

Star

Block outbound connections from mshta.exe using Microsoft Intune Firewall Rules

hardening intune windows-firewall microsoft-intune mitre-attack secure-score endpoint-security windows-security lolbas mshta microsoft-security

Updated May 27, 2026

malcorex / Real-World-Malware-Analysis

Star

Technical analysis of a real-world HTA downloader sample, including behavioral analysis, execution flow, IoCs, detection opportunities, and defensive recommendations.

windows ioc reverse-engineering malware cybersecurity malware-analysis hta malware-research vbscript soc malware-samples real-world malware-detection malware-analysiss mshta analysis-malware

Updated Jul 31, 2026
HTML

OsmanDhaqane / living-off-the-land-attacks-tryhackme

Star

TryHackMe walkthrough focused on detecting Living Off the Land activity using trusted Windows tools, SIEM alerts, and command-line analysis.

powershell incident-response scheduled-tasks dfir cybersecurity siem soc wmic blue-team rundll32 certutil threat-detection lolbins living-off-the-land windows-security tryhackme mshta

Updated Apr 29, 2026

yev-cyber / dfir-malware-investigation

Star

Sanitized DFIR case study of a fake CAPTCHA malware delivery chain involving mshta, obfuscated PowerShell, LOTL behavior, IOC analysis, and remediation actions.

ioc powershell incident-response dfir cybersecurity threat-hunting malware-analysis digital-forensics investigation mshta lotl infostealers

Updated May 25, 2026

Navigation Menu

mshta

Here are 13 public repositories matching this topic...

gnh1201 / welsonjs

ildar-shaimordanov / my-scripts

AHMUJia / claude-chatmap

datadiode / cehta

otnc / captcha-like-fake-captcha

Rednexie / RSPG

akuafif / HTA-Map-Network-Printer

Tam-George10 / Ransomware-Detection-Engineering

Modern-IE / IE-Engine-Bridge

seb1k / block-mshta-with-intune

malcorex / Real-World-Malware-Analysis

OsmanDhaqane / living-off-the-land-attacks-tryhackme

yev-cyber / dfir-malware-investigation

Add this topic to your repo