huntrule

Suspicious Script Interpreter Spawned by mshta

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-10-10
Updated
2026-10-10
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects mshta.exe spawning a scripting interpreter such as powershell, wscript or cscript. The Horabot Sapecar infection chain used mshta to launch an HTA that pivoted through JavaScript, VBScript and PowerShell before deploying its Delphi payload as reported by Kaspersky. An mshta process creating a script host child is a strong indicator of a staged living-off-the-land execution chain.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Malicious mshta Spawning PowerShell Loader via ClickFix
Malicious Forfiles Proxy Execution Launching PowerShell and MSHTA in PEAKLIGHT Chain (via process_creation)
Malicious ClickFix PowerShell Launching mshta with Remote URL (via process_creation)
Suspicious PowerShell Query of MSHTA Application Class in PEAKLIGHT Chain (via ps_script)
Windows: PowerShell-triggered HTA retrieval and execution with registry and process disruption
Suspicious PowerShell Decoding Base64 Payload Stored in Registry
Suspicious PowerShell WebClient UploadString Network Beacon
Suspicious PowerShell Execution of AdobeMon Script with Bypass Policy
Suspicious PowerShell Execution Bypass Running Script From ProgramData
Suspicious Script Interpreter Spawned by mshta
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.