huntrule

Suspicious Mshta Execution From AppData Directory

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-11-03
Updated
2026-11-03
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects mshta.exe executing from a user AppData path rather than the System32 directory. In the WithSecure Attack Detection Fundamentals Windows Lab 2, a malicious HTA staged in %APPDATA% is launched to load a DLL via registration-free COM and inject into notepad. Attackers abuse the trusted mshta binary from an unusual location to proxy execution and evade defenders.

Reporting behind it

Related detections9 linkedT1218.005 — drag to rearrange
Malicious mshta Inline JavaScript GetObject Scriptlet Execution
Malicious DLL Written to User Directory by mshta
Suspicious Remote HTA Execution via Mshta (via process_creation)
Suspicious .NET Utility Spawned by Script Host for Process Hollowing
Suspicious Masqueraded mshta Execution from ProgramData
Suspicious PowerShell Spawning mshta for Malware Execution (via process_creation)
Malicious Remote HTA Download and Execution via mshta by UAC-0050 (via process_creation)
Malicious Metasploit Stager Delivery via mshta Remote HTA (via process_creation)
Malicious mshta Launching WScript VBScript Loader
Suspicious Mshta Execution From AppData Directory
Pivot detection · T1218.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.