huntrule

Windows mshta.exe Execution Using Non-HTA File Extensions

Alerts on mshta.exe launched with command-line indicators for suspicious non-HTA file types and VBScript.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2019-02-22
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process execution of mshta.exe when the command line references file extensions and related content indicators that do not commonly represent HTML Application (HTA) inputs. Attackers may abuse this legitimate Windows utility to load malicious scripts disguised as benign files or served under misleading extensions to evade other detections. The detection relies on Windows process creation telemetry, matching mshta.exe and scanning the command line for a list of suspicious extensions and the string vbscript.

Reporting behind it

Related detections9 linkedT1218.005 — drag to rearrange
Windows: Alert on suspicious parent process spawning csc.exe
Windows Remote Thread Creation via CACTUSTORCH Using Script/Office/Rundll Host Images
Malicious Metasploit Stager Delivery via mshta Remote HTA (via process_creation)
Malicious mshta Launching WScript VBScript Loader
Suspicious Hidden PowerShell Spawned by Script Host via process_creation
Suspicious Kimsuky Remote HTA Payload Execution via mshta (via process_creation)
Suspicious mshta Execution of Inline JavaScript
Suspicious Bash Decode Chain Using curl xxd and base64 Piped to eval via Linux Shell
Suspicious Command Interpreter Spawned by mshta (via process_creation)
Windows mshta.exe Execution Using Non-HTA File Extensions
Pivot detection · T1218.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.