T1218.005 — Mshta

Tactic: Stealth · Platforms: Windows

Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code Mshta.exe is a utility that…

Sub-technique of System Binary Proxy Execution (T1218).

Sigma detection rules (1)

T1218.005 System Binary Proxy Execution: Mshta

title: "T1218.005 System Binary Proxy Execution: Mshta"
id: b30ebeb6-6d89-4fbe-9528-a03767ba8f10
description: 'Detecting Mshta-based Proxy Execution via Suspicious HTA or Script Invocation. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: CommandLinePattern, SuspiciousParentProcesses, AllowedHTASources, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1218/005
author: Shahrukh Khan
date: 2026-01-10
license: MIT
tags:
  - attack.stealth
  - attack.t1218.005

logsource:
  category: process_creation
  product: windows

detection:
  selection:
    EventID: '1'
    Image|endswith: '\mshta.exe'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate administrative use of mshta.exe to run signed internal HTA tools.

level: medium

Related sub-techniques

Explore