System Binary Proxy Execution: Mshta

APT29 has use mshta to execute malicious scripts on a compromised host.^[9]

APT32 has used mshta.exe for code execution.^[10][11]

APT38 has used a renamed version of mshta.exe to execute malicious HTML files.^[12]

BabyShark has used mshta.exe to download and execute applications from a remote server.^[13]

During C0015, the threat actors used mshta to execute DLLs.^[14]

Confucius has used mshta.exe to execute malicious VBScript.^[15]

Covenant can create HTA files to install Grunt listeners.^[16]

Earth Lusca has used mshta.exe to load an HTA script within a malicious .LNK file.^[17]

FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.^[5]

Gamaredon Group has used mshta.exe to execute malicious files.^{[18][19][20][21]}

Inception has used malicious HTA files to drop and execute malware.^[22]

Kimsuky has used mshta.exe to run malicious scripts on the system.^{[23][13][24][25]}

Koadic can use mshta to serve additional payloads and to help schedule tasks for persistence.^[26][27]

Lazarus Group has used mshta.exe to execute HTML pages downloaded by initial access documents.^[28][29]

LazyScripter has used mshta.exe to execute Koadic stagers.^[27]

Lumma Stealer has used mshta.exe to execute additional content.^[30][31]

Metamorfo has used mshta.exe to execute a HTA payload.^[32]

MuddyWater has used mshta.exe to execute its POWERSTATS payload and to pass a PowerShell one-liner for execution.^[33][34]

Mustang Panda has used mshta.exe to launch collection scripts.^[35]

NanHaiShu uses mshta.exe to load its program and files.^[36]

During Operation Dust Storm, the threat actors executed JavaScript code via mshta.exe.^[1]

POWERSTATS can use Mshta.exe to execute additional payloads on compromised hosts.^[33]

Pteranodon can use mshta.exe to execute an HTA file hosted on a remote server.^[18]

Revenge RAT uses mshta.exe to run malicious scripts on the system.^[37]

Sibot has been executed via MSHTA application.^[38]

SideCopy has utilized mshta.exe to execute a malicious hta file.^[39]

Sidewinder has used mshta.exe to execute malicious payloads.^[40][41]

TA2541 has used mshta to execute scripts including VBS.^[42]

TA551 has used mshta.exe to execute malicious payloads.^[43]

Xbash can use mshta for executing scripts.^[44]

Mshta.exe may not be necessary within a given environment since its functionality is tied to older versions of Internet Explorer that have reached end of life.

Use application control configured to block execution of mshta.exe if it is not required for a given system or network to prevent potential misuse by adversaries. For example, in Windows 10 and Windows Server 2016 and above, Windows Defender Application Control (WDAC) policy rules may be applied to block the mshta.exe application and to prevent abuse.^[45]