Wiki › Techniques, Tactics & Procedures (TTPs) › Execution › MSHTA and HTML Application Execution

MSHTA and HTML Application Execution

2 min read

Jump to:

Overview

MSHTA is a Windows utility that executes HTML Applications (HTA), which are HTML files with embedded scripts capable of running with system-level permissions. Adversaries leverage MSHTA to execute malicious scripts or payloads during various stages of an attack lifecycle, exploiting its ability to run code without invoking traditional executable files, thereby aiding stealth and evasion.

Attack Objective

Execute arbitrary code or scripts to gain control or persist within a target environment
Supports multiple attack lifecycle stages including Initial Access, Execution, Persistence, and Defense Evasion
Advances attacker position by enabling script-based payload execution that can bypass application whitelisting and detection mechanisms

How the Technique Works

MSHTA executes HTML Applications, which are HTML files containing embedded scripting languages such as VBScript or JScript. When invoked, MSHTA processes the HTA file and executes its script content with the privileges of the user context. This capability allows attackers to deliver and run malicious code without relying on traditional executable binaries, often bypassing security controls that focus on executable files.

Common Methods & Variations

Execution of malicious HTA files delivered via phishing emails, drive-by downloads, or lateral movement
Use in on-premises Windows environments primarily, but can be leveraged in cloud-connected endpoints
Living-off-the-land approach utilizing the built-in MSHTA utility rather than deploying custom malware binaries

Indicators of Compromise (IOCs)

Execution logs showing mshta.exe launching with unusual or suspicious HTA file arguments
Network connections initiated by mshta.exe processes to external command and control servers
Presence of unexpected HTA files in user directories or temporary folders

Detection Strategies

Monitoring process creation logs for mshta.exe usage, particularly with uncommon command-line parameters
Behavioral detection focusing on mshta.exe spawning network connections or executing scripts from non-standard locations
Correlation of email gateway alerts with endpoint telemetry to identify phishing campaigns delivering HTA payloads

Mitigation & Prevention

Application control policies restricting or blocking mshta.exe execution where not required
Disabling or limiting HTA file execution via group policy or software restriction policies
User training to recognize and avoid phishing attempts delivering HTA files

Response Considerations

Immediate isolation of affected systems to prevent further execution or lateral movement
Forensic analysis of mshta.exe execution events and associated HTA files to determine scope and intent
Removal of malicious HTA files and review of endpoint controls to prevent recurrence

Related Techniques

Execution through other living-off-the-land binaries such as PowerShell or WScript
Phishing or spear-phishing delivery mechanisms for initial access
Persistence via scheduled tasks or registry modifications triggered by HTA execution

Mapping & References

MITRE ATT&CK: T1218.005 – Signed Binary Proxy Execution: Mshta
Public advisories on living-off-the-land binaries and script execution abuse
Incident reports highlighting mshta.exe usage in targeted attacks and malware campaigns

Tags: Defense Evasion Execution HTA Initial Access Living-off-the-Land mshta persistence Script Execution T1218.005 Windows