huntrule

Malicious DLL Written to User Directory by mshta

PremiumReviewedSigma · High · v1
Product
windows
Category
file_event
Author
HuntRule
Published
2026-11-02
Updated
2026-11-02
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects the mshta LOLBIN writing a DLL into a user writable directory such as AppData or Temp which is the payload staging step described in the WithSecure Windows lab where an HTA decoded and dropped a DLL before loading it through registration free COM. A trusted script host dropping a DLL to a user path is anomalous and indicative of defense evasion and staging.

Reporting behind it

Related detections9 linkedT1218.005 — drag to rearrange
Suspicious Remote HTA Execution via Mshta (via process_creation)
Suspicious .NET Utility Spawned by Script Host for Process Hollowing
Suspicious Masqueraded mshta Execution from ProgramData
Suspicious PowerShell Spawning mshta for Malware Execution (via process_creation)
Malicious Remote HTA Download and Execution via mshta by UAC-0050 (via process_creation)
Malicious Metasploit Stager Delivery via mshta Remote HTA (via process_creation)
Malicious mshta Launching WScript VBScript Loader
Suspicious Kimsuky Remote HTA Payload Execution via mshta (via process_creation)
Suspicious mshta Execution of Inline JavaScript
Malicious DLL Written to User Directory by mshta
Pivot detection · T1218.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.