How to defend against mshta script execution

What the attacker does

mshta.exe runs HTML Applications: HTML files with VBScript or JScript that run with the user's rights, outside the browser's restrictions. An attacker uses it to run script code in three ways: inline on the command line (mshta vbscript:... or mshta javascript:...), from a local .hta file, or from a URL. The program is signed by Microsoft and present on every Windows installation, so an application allowlist that trusts Windows binaries lets it run.

What it looks like in the logs

A process creation event (Sysmon Event ID 1, or Windows Security Event ID 4688 with command line auditing) for mshta.exe. The command line carries the script or the file, and the parent is usually a shell, an Office application or a browser. This is one of the starts in the recordings:

What the script does shows up as child processes of mshta.exe (here PowerShell) and, for remote content, as network connections from mshta.exe.

Detect

Measured on the challenge data: the rule caught 3 of 3 attack events and matched 0 of 2,224 normal events.

title: mshta.exe started
id: 3b9d6f2e-8a41-4c7e-9f15-6d2a0c8e4b71
status: test
description: Detects mshta.exe, the Windows host for HTML Applications, also when the file was copied and renamed. Most environments have no legitimate use for it; where they do, add the known applications as filters.
references:
  - https://attack.mitre.org/techniques/T1218/005/
  - https://howdefend.com/defend/mshta-script-execution/
author: Bartu Kılıç
date: 2026-10-20
tags:
  - attack.defense-evasion
  - attack.t1218.005
logsource:
  product: windows
  category: process_creation
detection:
  selection_path:
    Image|endswith: '\mshta.exe'
  selection_original_name:
    OriginalFileName: 'MSHTA.EXE'
  condition: 1 of selection_*
falsepositives:
  - Legacy administration tools and installers built as HTML Applications
level: high

What the rule misses

• Another program running the same script. VBScript and JScript can also run through wscript.exe, cscript.exe or rundll32.exe with a javascript: argument. The rule watches one program.
• What the script did. The rule fires on the start. Child processes, network connections and file writes need their own rules.
• Environments that use HTML Applications. Some old administration tools and installers are HTAs. Each of them is a false positive until it is filtered, by full path and command line rather than by the parent's name.

Prevent

• Block it. If no application in the environment needs HTML Applications, deny mshta.exe with App Control for Business or AppLocker. Microsoft's recommended block rules for App Control include it.
• Keep the detection after blocking. A blocked start still produces an event in the App Control or AppLocker log, which is a high-quality alert: nothing legitimate should try.

Practice

Write the rule yourself on the same data, with every target labelled.

Sources

• MITRE ATT&CK: T1218.005 Mshta
• Microsoft Learn: Applications that can bypass App Control and how to block them
• OTRF Security-Datasets (attack recordings used on this page)