T1218.005
Mshta
What it is
Attackers use mshta.exe, the signed Windows program that runs HTML Applications, to run their own script code under a trusted name. It is a sub-technique of System Binary Proxy Execution.
An HTML Application, or HTA, is a web page with the full access of a local program, usually written in VBScript or JavaScript. mshta.exe runs one from a file, from a web address, or from script written directly on its command line, and because it is part of Windows and signed by Microsoft, controls that trust system programs can let it through.
How adversaries use it
The attacker gets mshta.exe to run their script: an HTA file delivered by email or download and opened by the user, a web address on mshta's command line so the script is fetched and run without being saved as a file, or a few lines of script passed inline. The script then does the real work, typically starting another program or downloading the next stage, while a process list shows only a familiar Windows program.
Detect it in Elastic
Data source: Windows process creation events (Sysmon and Windows Security), with Sysmon's network connection events
Key fields
event.code: 1 (Sysmon) or 4688 (Windows Security) when a process starts process.name: mshta.exe process.command_line: the HTA file, web address or inline script it was given process.parent.name: what started it process.pe.original_file_name: still names mshta if the program was copied and renamed (Sysmon, Elastic Defend) event.code: 3 (Sysmon) when it makes a network connection, with destination.ip and destination.domain user.name: the account it ran as host.name, @timestamp
Example event
{
"host": {
"name": "ws-307.corp.example"
},
"user": {
"name": "m.castell"
},
"event": {
"code": "1"
},
"process": {
"name": "mshta.exe",
"parent": {
"name": "explorer.exe"
},
"command_line": "mshta.exe E:\\Depot\\notice.hta"
},
"@timestamp": "2026-06-02T14:31:18.506Z"
}Prebuilt Elastic rule: Script Execution via Microsoft HTML Application
Hunt guidance
Start with every mshta.exe start and read its command lines: process.name: "mshta.exe". Most hosts run it rarely, if ever, so the list is short. Look for a web address or script code in the command line, HTA files in temporary, download or removable folders, a parent that is a document viewer or a script host, and processes or network connections that mshta.exe starts soon after it runs. A renamed copy will not match the name, so also search process.pe.original_file_name where your data records it.
The prebuilt rule named on this page looks for script code or a web address in mshta's command line, and for HTA files opened from the Downloads folder or unpacked from an archive; an HTA run from anywhere else by its plain path will not trigger it, which is the case this page's example shows and this hunt covers.
Ruling out legitimate activity
Some older administrative tools, installers and vendor support utilities are still written as HTML Applications, and they run mshta.exe with an HTA from their own installed folder. Check the HTA's path and what placed it there, the parent process, and whether the same command line runs across many hosts as part of managed software. An HTA from a user's download or temporary folder, or a web address on the command line, is rarely legitimate.
Telemetry needed
References
Practice it
No range covers this technique yet; the write-up above landed first. Ranges are added continuously; the ones live today are on the training ladder.