huntrule

Suspicious mshta Executing Remote Content via ClickFix Lure

PremiumReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-10-14
Updated
2026-10-14
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects mshta.exe launching remote HTA or scriptlet content from an HTTP or HTTPS URL. Microsoft observed Lumma Stealer delivered through ClickFix lures that pasted mshta commands pointing to attacker infrastructure. Using mshta as a proxy to run remote payloads bypasses application controls, so remote invocation is a reliable malicious signal.

Reporting behind it

Related detections9 linkedT1218.005 — drag to rearrange
Suspicious mshta Launched from Explorer via ClickFix Run Dialog (via process_creation)
Suspicious msdt Execution of Audio Diagnostic via UNC1069 ClickFix
Suspicious PowerShell Loader Spawned by mshta via UNC5142 ClickFix
Suspicious Script Interpreter Spawned by mshta
Suspicious mshta.exe Executing Remote Media-Extension URL
Malicious Mshta Spawned by WMI or WinRM Provider via process_creation
Suspicious mshta.exe Executing Embedded JavaScript from LNK Chain (via process_creation)
Suspicious VBScript Code Stored in CurrentVersion Registry Value
Suspicious rundll32 or mshta Proxy Execution of VBScript
Suspicious mshta Executing Remote Content via ClickFix Lure
Pivot detection · T1218.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.