Windows mshta.exe Process Creation Triggered by Suspicious Command Lines
Alert on mshta.exe launches from suspicious parents and script-like command lines/paths.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-07-17
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags suspicious process creation events where mshta.exe is executed, either by matching the mshta executable image/name or by specific command-line context. It focuses on risky parent processes (such as cmd.exe, PowerShell, wscript/cscript, regsvr32, and rundll32) combined with locations and arguments commonly used to stage script-based payloads. The detection relies on Windows process creation telemetry, including Image, OriginalFileName, ParentImage, and CommandLine.
Reporting behind it
- en.wikipedia.orghttps://en.wikipedia.org/wiki/HTML_Application
- echotrail.iohttps://www.echotrail.io/insights/search/mshta.exe
- app.any.runhttps://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mshta_susp_pattern.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows mshta.exe Process Creation Triggered by Suspicious Command Lines
id: cec22bdb-6acc-4540-8254-7f72350ed333
status: test
description: This rule flags suspicious process creation events where mshta.exe is executed, either by matching the mshta executable image/name or by specific command-line context. It focuses on risky parent processes (such as cmd.exe, PowerShell, wscript/cscript, regsvr32, and rundll32) combined with locations and arguments commonly used to stage script-based payloads. The detection relies on Windows process creation telemetry, including Image, OriginalFileName, ParentImage, and CommandLine.
references:
- https://en.wikipedia.org/wiki/HTML_Application
- https://www.echotrail.io/insights/search/mshta.exe
- https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mshta_susp_pattern.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-07-17
modified: 2023-02-21
tags:
- attack.execution
- attack.t1106
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \mshta.exe
- OriginalFileName: MSHTA.EXE
selection_susp:
ParentImage|endswith:
- \cmd.exe
- \cscript.exe
- \powershell.exe
- \pwsh.exe
- \regsvr32.exe
- \rundll32.exe
- \wscript.exe
CommandLine|contains:
- \AppData\Local\
- C:\ProgramData\
- C:\Users\Public\
- C:\Windows\Temp\
filter_img:
- Image|startswith:
- C:\Windows\System32\
- C:\Windows\SysWOW64\
- CommandLine|contains:
- .htm
- .hta
- CommandLine|endswith:
- mshta.exe
- mshta
condition: all of selection_* or (selection_img and not filter_img)
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: e32f92d1-523e-49c3-9374-bdb13b46a3ba
type: derived