Create win_mshta_invoke_html.yml

rules/windows/process_creation/win_mshta_invoke_html.yml

@@ -0,0 +1,31 @@
+status: experimental
+author: Beyu Denis, oscd.community
+date: 2020/10/18
+description: Invoke an HTML Application via mshta.exe (Note - Pops a security warning and a print dialogue box).
+references:
+    - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Mshtml.yml
+	- https://twitter.com/pabraeken/status/998567549670477824
+	- https://windows10dll.nirsoft.net/mshtml_dll.html
+tags:
+    - attack.execution
+    - attack.t1085
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection:
+        ProcessCommandline|contains|all: 
+            - 'Mshtml.dll'
+            - 'PrintHTML'
+        Image|endswith:: 
+            - '\rundll32.exe'
+    condition: selection
+fields:
+    - ComputerName
+    - User
+    - CommandLine
+    - ParentCommandLine    
+falsepositives:
+    - System administrator Usage
+    - Penetration test 
+level: medium