Windows mshta.exe Execution Using Non-HTA File Extensions

Alerts on mshta.exe launched with command-line indicators for suspicious non-HTA file types and VBScript.

FreeUnreviewedSigmahighv1

windows-mshta-exe-execution-using-non-hta-file-extensions-cc7abbd0

title: Windows mshta.exe Execution Using Non-HTA File Extensions
id: 671c98a0-3cce-4e75-a432-b6582e9dc154
status: test
description: This rule flags process execution of mshta.exe when the command line references file extensions and related content indicators that do not commonly represent HTML Application (HTA) inputs. Attackers may abuse this legitimate Windows utility to load malicious scripts disguised as benign files or served under misleading extensions to evade other detections. The detection relies on Windows process creation telemetry, matching mshta.exe and scanning the command line for a list of suspicious extensions and the string vbscript.
references:
  - http://blog.sevagas.com/?Hacking-around-HTA-files
  - https://0x00sec.org/t/clientside-exploitation-in-2018-how-pentesting-has-changed/7356
  - https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/xml/xslt/xslt-stylesheet-scripting-using-msxsl-script
  - https://medium.com/tsscyber/pentesting-and-hta-bypassing-powershell-constrained-language-mode-53a42856c997
  - https://twitter.com/mattifestation/status/1326228491302563846
  - https://www.virustotal.com/gui/file/c1f27d9795a2eba630db8a043580a0761798f06370fb1317067805f8a845b00c
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mshta_susp_execution.yml
author: Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2019-02-22
modified: 2025-05-12
tags:
  - attack.stealth
  - attack.t1140
  - attack.t1218.005
  - attack.execution
  - attack.t1059.007
  - cve.2020-1599
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \mshta.exe
    - OriginalFileName: mshta.exe
  selection_cli:
    CommandLine|contains:
      - .7z
      - .avi
      - .bat
      - .bmp
      - .conf
      - .csv
      - .dll
      - .doc
      - .gif
      - .gz
      - .ini
      - .jpe
      - .jpg
      - .json
      - .lnk
      - .log
      - .mkv
      - .mp3
      - .mp4
      - .pdf
      - .png
      - .ppt
      - .rar
      - .rtf
      - .svg
      - .tar
      - .tmp
      - .txt
      - .xls
      - .xml
      - .yaml
      - .yml
      - .zip
      - vbscript
  condition: all of selection_*
falsepositives:
  - False positives depend on scripts and administrative tools used in the monitored environment
level: high
license: DRL-1.1
related:
  - id: cc7abbd0-762b-41e3-8a26-57ad50d2eea3
    type: derived

What it detects

This rule flags process execution of mshta.exe when the command line references file extensions and related content indicators that do not commonly represent HTML Application (HTA) inputs. Attackers may abuse this legitimate Windows utility to load malicious scripts disguised as benign files or served under misleading extensions to evade other detections. The detection relies on Windows process creation telemetry, matching mshta.exe and scanning the command line for a list of suspicious extensions and the string vbscript.

Known false positives

False positives depend on scripts and administrative tools used in the monitored environment

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.