T1218.005Stealth
Mshta
Adversaries may abuse mshta.exe to proxy execution of malicious.hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code Mshta.exe is a utility that executes Microsoft HTML Applications (HTA) files. HTAs are standalone applications that execute using…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
8 Sigma rules tagged T1218.005MshtaT1218.0058 general rules
- Csc.EXE Execution Form Potentially Suspicious Parenthightest
- HackTool - CACTUSTORCH Remote Thread Creationhightest
- MSHTA Execution with Suspicious File Extensionshightest
- Potential Baby Shark Malware Activityhightest
- Potential LethalHTA Technique Executionhightest
- Remotely Hosted HTA File Executed Via Mshta.EXEhightest
- Suspicious JavaScript Execution Via Mshta.EXEhightest
- Suspicious MSHTA Child Processhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Mshta
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.