Windows Mshta.exe Launching JavaScript via Command Line
Detects Mshta.exe executions where the command line includes "javascript".
- Product
- windows
- Category
- process_creation
- Author
- E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community (SigmaHQ), DRL 1.1
- Published
- 2019-10-24
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where Mshta.exe is executed with a command line containing the term "javascript". Attackers commonly use Mshta as a proxy execution method to run script content without spawning a typical scripting host, which can help evade simpler detections. It relies on Windows process creation telemetry, matching the executable path/name and searching the process command line for the JavaScript keyword.
Reporting behind it
- eqllib.readthedocs.iohttps://eqllib.readthedocs.io/en/latest/analytics/6bc283c4-21f2-4aed-a05c-a9a3ffa95dd4.html
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.005/T1218.005.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mshta_javascript.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Mshta.exe Launching JavaScript via Command Line
id: bdbc43b4-9fdb-4f52-a1a5-cb843b9156f0
status: test
description: This rule flags process creation events where Mshta.exe is executed with a command line containing the term "javascript". Attackers commonly use Mshta as a proxy execution method to run script content without spawning a typical scripting host, which can help evade simpler detections. It relies on Windows process creation telemetry, matching the executable path/name and searching the process command line for the JavaScript keyword.
references:
- https://eqllib.readthedocs.io/en/latest/analytics/6bc283c4-21f2-4aed-a05c-a9a3ffa95dd4.html
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.005/T1218.005.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mshta_javascript.yml
author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Huntrule Team
date: 2019-10-24
modified: 2023-02-07
tags:
- attack.stealth
- attack.t1218.005
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \mshta.exe
- OriginalFileName: MSHTA.EXE
selection_cli:
CommandLine|contains: javascript
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 67f113fa-e23d-4271-befa-30113b3e08b1
type: derived