Windows mshta.exe Execution Using Non-HTA File Extensions

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1059.007JavaScript
Persistence
Priv Esc
Defense Evasion
- T1140Deobfuscate/Decode Files or Information
- T1218.005Mshta
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process execution of mshta.exe when the command line references file extensions and related content indicators that do not commonly represent HTML Application (HTA) inputs. Attackers may abuse this legitimate Windows utility to load malicious scripts disguised as benign files or served under misleading extensions to evade other detections. The detection relies on Windows process creation telemetry, matching mshta.exe and scanning the command line for a list of suspicious extensions and the string vbscript.

Reporting behind it

Related detections9 linkedT1059.007 — drag to rearrange

Windows: Alert on suspicious parent process spawning csc.exe

Windows Remote Thread Creation via CACTUSTORCH Using Script/Office/Rundll Host Images

Suspicious Shell Command Obfuscation via printf Escape Encoding on VMware ESXi (via process_creation)

Suspicious MSHTA Execution Spawned by Browser or Document Reader via Mispadu (via process_creation)

Suspicious npm Postinstall Node Execution From Fixtures Path (BeaverTail OtterCookie)

Suspicious Script Host Execution of Decoy-Named JavaScript Dropper (PS1Bot)

Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell

Suspicious Office Application Spawning Mshta With Remote HTA

Suspicious Script Host Spawning PowerShell With Bypass And Hidden Execution

Windows mshta.exe Execution Using Non-HTA File Extensions

Pivot detection · T1059.007 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-mshta-exe-execution-using-non-hta-file-extensions-cc7abbd0

title: Windows mshta.exe Execution Using Non-HTA File Extensions
id: 671c98a0-3cce-4e75-a432-b6582e9dc154
status: test
description: This rule flags process execution of mshta.exe when the command line references file extensions and related content indicators that do not commonly represent HTML Application (HTA) inputs. Attackers may abuse this legitimate Windows utility to load malicious scripts disguised as benign files or served under misleading extensions to evade other detections. The detection relies on Windows process creation telemetry, matching mshta.exe and scanning the command line for a list of suspicious extensions and the string vbscript.
references:
  - http://blog.sevagas.com/?Hacking-around-HTA-files
  - https://0x00sec.org/t/clientside-exploitation-in-2018-how-pentesting-has-changed/7356
  - https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/xml/xslt/xslt-stylesheet-scripting-using-msxsl-script
  - https://medium.com/tsscyber/pentesting-and-hta-bypassing-powershell-constrained-language-mode-53a42856c997
  - https://twitter.com/mattifestation/status/1326228491302563846
  - https://www.virustotal.com/gui/file/c1f27d9795a2eba630db8a043580a0761798f06370fb1317067805f8a845b00c
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mshta_susp_execution.yml
author: Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2019-02-22
modified: 2025-05-12
tags:
  - attack.stealth
  - attack.t1140
  - attack.t1218.005
  - attack.execution
  - attack.t1059.007
  - cve.2020-1599
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \mshta.exe
    - OriginalFileName: mshta.exe
  selection_cli:
    CommandLine|contains:
      - .7z
      - .avi
      - .bat
      - .bmp
      - .conf
      - .csv
      - .dll
      - .doc
      - .gif
      - .gz
      - .ini
      - .jpe
      - .jpg
      - .json
      - .lnk
      - .log
      - .mkv
      - .mp3
      - .mp4
      - .pdf
      - .png
      - .ppt
      - .rar
      - .rtf
      - .svg
      - .tar
      - .tmp
      - .txt
      - .xls
      - .xml
      - .yaml
      - .yml
      - .zip
      - vbscript
  condition: all of selection_*
falsepositives:
  - False positives depend on scripts and administrative tools used in the monitored environment
level: high
license: DRL-1.1
related:
  - id: cc7abbd0-762b-41e3-8a26-57ad50d2eea3
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL