Hands-On Red Team Tactics

Why use MSHTA as the dropper payload?

One of the coolest reasons of using MSHTA for payload delivery is its support for scripting languages, such as VBScript and JScript, and as it's explained in the introductory part of this tool, Koadic does not uses PowerShell for post-exploitation. PowerShell was a really great playground for attackers and red-teamers for years and like every good playground, there comes a time when it gets too messy. Nowadays, even if you encode the PowerShell command into base64 or any other encoder, the payload delivery still gets detected by so-called AntiVirus with Machine Learning and Artificial Intelligence. The reason for this is that instead of trying to detect the payload command or the shellcode embedded in ...