Mshta launching remote or inline script content

Siemphony@siemphonymediumT1218.005verified in labPlaybook · Unexpected execution

Matches the process-creation leg of AN1397: a `mshta.exe` start whose command line carries the two things that distinguish proxied execution from opening a local application — content fetched from off the host, or script handed to the HTA engine inline rather than as a file — plus a third arm for the parent processes MITRE's `SuspiciousParentProcesses` knob names, populated here with the Office applications and the WSH interpreters. A bare `mshta.exe` gate is deliberately not used on its own: mshta is a shipped Windows binary and an in-house `.hta` opened from a desktop shortcut produces the same image name, so every arm is a second gate applied on top of it. Three limits are worth stating plainly. The analytic's Sysmon EventID 3 and 22 legs describe the network fetch, and its EventID 11 leg the file the payload drops, but each is a separate event that MITRE's `TimeWindow` knob correlates with this one — a cross-event join lib/sigma cannot express — so this rule stops at the invocation. An HTA already staged on disk by an earlier stage and run as `mshta.exe C:\Users\Public\x.hta` matches no arm here unless its parent is one of the listed ones. And `AllowedHTASources` is a knob for an allowlist a site has to build, not something a shipped rule can populate. Vocabulary and prerequisite: this is written in the Sysmon-shaped `process_creation` vocabulary the brief specifies, and the brief feeds it from Security EventID 4688, where `Image` maps to `NewProcessName` and `ParentImage` to `ParentProcessName`. That feed needs *Audit Process Creation*, and two of the three arms read `CommandLine`, which needs the separate *Include command line in process creation events* policy — without it those arms return zero rows, and zero rows reads as quiet when it actually means blind. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0506, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Mshta launching remote or inline script content2id: 0c5fdea0-050b-49f2-ac6e-a69476df4ed13status: experimental4description: |5  Matches the process-creation leg of AN1397: a `mshta.exe` start whose command6  line carries the two things that distinguish proxied execution from opening a7  local application — content fetched from off the host, or script handed to the8  HTA engine inline rather than as a file — plus a third arm for the parent9  processes MITRE's `SuspiciousParentProcesses` knob names, populated here with10  the Office applications and the WSH interpreters. A bare `mshta.exe` gate is11  deliberately not used on its own: mshta is a shipped Windows binary and an12  in-house `.hta` opened from a desktop shortcut produces the same image name, so13  every arm is a second gate applied on top of it. Three limits are worth stating14  plainly. The analytic's Sysmon EventID 3 and 22 legs describe the network15  fetch, and its EventID 11 leg the file the payload drops, but each is a16  separate event that MITRE's `TimeWindow` knob correlates with this one — a17  cross-event join lib/sigma cannot express — so this rule stops at the18  invocation. An HTA already staged on disk by an earlier stage and run as19  `mshta.exe C:\Users\Public\x.hta` matches no arm here unless its parent is one20  of the listed ones. And `AllowedHTASources` is a knob for an allowlist a site21  has to build, not something a shipped rule can populate. Vocabulary and22  prerequisite: this is written in the Sysmon-shaped `process_creation`23  vocabulary the brief specifies, and the brief feeds it from Security EventID24  4688, where `Image` maps to `NewProcessName` and `ParentImage` to25  `ParentProcessName`. That feed needs *Audit Process Creation*, and two of the26  three arms read `CommandLine`, which needs the separate *Include command line27  in process creation events* policy — without it those arms return zero rows,28  and zero rows reads as quiet when it actually means blind.29  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0506, not hand-written and not tested by its author. Any lab result is on this rule's own page.30references:31  - https://attack.mitre.org/techniques/T1218/00532  - https://attack.mitre.org/detectionstrategies/DET050633author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)34date: 2026-08-1635tags:36  - attack.defense-evasion37  - attack.t1218.00538logsource:39  category: process_creation40  product: windows41detection:42  selection_tool:43    Image|endswith: '\mshta.exe'44  context_remote_content:45    CommandLine|contains:46      - 'http://'47      - 'https://'48      - 'ftp://'49      - '\\\\'50  context_inline_script:51    CommandLine|contains:52      - 'vbscript:'53      - 'javascript:'54      - 'jscript:'55      - 'about:'56      - 'GetObject('57      - 'RunHTMLApplication'58  context_suspicious_parent:59    ParentImage|endswith:60      - '\winword.exe'61      - '\excel.exe'62      - '\powerpnt.exe'63      - '\outlook.exe'64      - '\msaccess.exe'65      - '\onenote.exe'66      - '\visio.exe'67      - '\wscript.exe'68      - '\cscript.exe'69      - '\eqnedt32.exe'70  condition: selection_tool and 1 of context_*71falsepositives:72  - "Line-of-business HTA applications published from a file share or an intranet site, which are launched as `mshta.exe \\fileserver\\apps\\tool.hta` or `mshta.exe http://intranet/tool.hta` and match the remote-content arm on every open. In an estate that still ships HTA front-ends this is the highest-volume match by a wide margin, and it is why this rule is medium rather than high."73  - "Vendor installers, uninstall stubs and OEM support tools that display a dialog or a progress window through a bundled `.hta` staged on a share, and legacy setup wrappers that call `mshta.exe vbscript:Close(...)` to close their own window — the documented idiom, and identical on the command line to the inline-script arm this rule targets."74  - "Help-desk and packaging scripts driven from `wscript.exe` or `cscript.exe` that hand a local `.hta` to mshta for a prompt, which matches the parent arm regardless of what the HTA does."75  - "Office documents belonging to internal tooling that legitimately shell out to an HTA form — a macro-enabled workbook opening its own front-end — which produces a winword.exe or excel.exe parent for a benign mshta child."76level: medium

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (FolderPath endswith "\\mshta.exe" and ((ProcessCommandLine contains "http://" or ProcessCommandLine contains "https://" or ProcessCommandLine contains "ftp://" or ProcessCommandLine contains "\\\\") or (ProcessCommandLine contains "vbscript:" or ProcessCommandLine contains "javascript:" or ProcessCommandLine contains "jscript:" or ProcessCommandLine contains "about:" or ProcessCommandLine contains "GetObject(" or ProcessCommandLine contains "RunHTMLApplication") or (InitiatingProcessFolderPath endswith "\\winword.exe" or InitiatingProcessFolderPath endswith "\\excel.exe" or InitiatingProcessFolderPath endswith "\\powerpnt.exe" or InitiatingProcessFolderPath endswith "\\outlook.exe" or InitiatingProcessFolderPath endswith "\\msaccess.exe" or InitiatingProcessFolderPath endswith "\\onenote.exe" or InitiatingProcessFolderPath endswith "\\visio.exe" or InitiatingProcessFolderPath endswith "\\wscript.exe" or InitiatingProcessFolderPath endswith "\\cscript.exe" or InitiatingProcessFolderPath endswith "\\eqnedt32.exe")))

Splunk · SPL

Run this as a search.

index=* (Image="*\\mshta.exe" AND ((CommandLine="*http://*" OR CommandLine="*https://*" OR CommandLine="*ftp://*" OR CommandLine="*\\\\*") OR (CommandLine="*vbscript:*" OR CommandLine="*javascript:*" OR CommandLine="*jscript:*" OR CommandLine="*about:*" OR CommandLine="*GetObject(*" OR CommandLine="*RunHTMLApplication*") OR (ParentImage="*\\winword.exe" OR ParentImage="*\\excel.exe" OR ParentImage="*\\powerpnt.exe" OR ParentImage="*\\outlook.exe" OR ParentImage="*\\msaccess.exe" OR ParentImage="*\\onenote.exe" OR ParentImage="*\\visio.exe" OR ParentImage="*\\wscript.exe" OR ParentImage="*\\cscript.exe" OR ParentImage="*\\eqnedt32.exe")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" AND ((TO_LOWER(process.command_line) LIKE "*http://*" OR TO_LOWER(process.command_line) LIKE "*https://*" OR TO_LOWER(process.command_line) LIKE "*ftp://*" OR TO_LOWER(process.command_line) LIKE "*\\\\\\\\*") OR (TO_LOWER(process.command_line) LIKE "*vbscript:*" OR TO_LOWER(process.command_line) LIKE "*javascript:*" OR TO_LOWER(process.command_line) LIKE "*jscript:*" OR TO_LOWER(process.command_line) LIKE "*about:*" OR TO_LOWER(process.command_line) LIKE "*getobject(*" OR TO_LOWER(process.command_line) LIKE "*runhtmlapplication*") OR (TO_LOWER(process.parent.executable) LIKE "*\\\\winword.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\excel.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\powerpnt.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\outlook.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\msaccess.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\onenote.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\visio.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\eqnedt32.exe")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 3 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\mshta\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(http://|https://|ftp://|\\\\)</field>    <description>Mshta launching remote or inline script content (1/3)</description>    <mitre>      <id>T1218.005</id>    </mitre>  </rule>   <rule id="100001" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\mshta\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(vbscript:|javascript:|jscript:|about:|GetObject\(|RunHTMLApplication)</field>    <description>Mshta launching remote or inline script content (2/3)</description>    <mitre>      <id>T1218.005</id>    </mitre>  </rule>   <rule id="100002" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\mshta\.exe$</field>    <field name="ParentImage" type="pcre2">(?i)(\\winword\.exe$|\\excel\.exe$|\\powerpnt\.exe$|\\outlook\.exe$|\\msaccess\.exe$|\\onenote\.exe$|\\visio\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\eqnedt32\.exe$)</field>    <description>Mshta launching remote or inline script content (3/3)</description>    <mitre>      <id>T1218.005</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: signed_binary_proxy
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 0c5fdea0-050b-49f2-ac6e-a69476df4ed1

ATT&CKT1218.005

T1218.005Mshta

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification2 runs

Verified in Siemphony lab

Security Datasets — mshta.exe running VBScript that launches PowerShell
passed
Siemphony IR · 3 Sept 2026
1 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1218.005, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Baseline your own HTAs first and turn them into an exclusion — that is what
Close the staged-file blind spot with a fourth arm on the argument path rather
Drop ftp://, jscript: and about: so the rule stops implying coverage it

Declared by the author

Line-of-business HTA applications published from a file share or an intranet site, which are launched as mshta.exe \fileserver\apps\tool.hta or mshta.exe http://intranet/tool.hta and match the remote-content arm on every open. In an estate that still ships HTA front-ends this is the highest-volume match by a wide margin, and it is why this rule is medium rather than high.
Vendor installers, uninstall stubs and OEM support tools that display a dialog or a progress window through a bundled .hta staged on a share, and legacy setup wrappers that call mshta.exe vbscript:Close(...) to close their own window — the documented idiom, and identical on the command line to the inline-script arm this rule targets.
Help-desk and packaging scripts driven from wscript.exe or cscript.exe that hand a local .hta to mshta for a prompt, which matches the parent arm regardless of what the HTA does.
Office documents belonging to internal tooling that legitimately shell out to an HTA form — a macro-enabled workbook opening its own front-end — which produces a winword.exe or excel.exe parent for a benign mshta child.

Lessonsigned binary proxy

signed binary proxyAI draft — unreviewed

01 · What this rule detects

AN1397 describes a chain: mshta.exe starts with arguments pointing at remote or inline script content, then fetches, drops or spawns. This rule implements the first link only — the invocation — because the network, DNS and file legs are separate events that MITRE's TimeWindow knob would correlate, and lib/sigma expresses no cross-event join. Say the consequence plainly: a hit is an mshta command line, not proven execution of a payload. And the converse matters more. An HTA already staged on disk and run as mshta.exe C:\Users\Public\x.hta carries no URL and no scheme, so it matches nothing here unless its parent happens to be listed. The real fireable surface is "fetched from off the host" or "launched by Office or WSH".

02 · Telemetry you need

category: process_creation / product: windows, copied verbatim from AN1397. The brief feeds that Sysmon-shaped category from Security EventID 4688, where Image maps to NewProcessName and ParentImage to ParentProcessName — so a raw 4688 feed needs that mapping applied before any arm can match. It also needs Audit Process Creation, and two of three arms read CommandLine, which needs the separate Include command line in process creation events policy. Without it those arms return zero rows, and zero rows reads as quiet when it means blind. All four backends render the rule.

03 · How the logic works

selection_tool is the gate: Image|endswith: '\mshta.exe'. It is never used alone, because mshta is a shipped Windows binary and an in-house HTA opened from a shortcut produces exactly the same image name. The condition is selection_tool and 1 of context_* — three second gates on top of it. context_remote_content matches CommandLine|contains on http://, https://, ftp:// and '\\\\'. That last value is four backslashes in single-quoted YAML, which is two literal ones — a UNC prefix. Written with two it would degrade to "contains a backslash", which every Windows path satisfies. ftp:// is dead weight; file:// would have been the better fourth value. context_inline_script matches script schemes and moniker fragments. Three of its six values cannot co-occur with an mshta image: RunHTMLApplication is the rundll32 idiom (T1218.011), jscript: is not a registered moniker, and about: is a browser scheme. Treat vbscript:, javascript: and GetObject( as the live values. context_suspicious_parent is MITRE's SuspiciousParentProcesses knob, populated here by the pipeline with seven Office binaries plus wscript.exe and cscript.exe. MITRE names the knob and gives the categories; the ten filenames are the author's.

04 · Common false positives

The remote-content arm is the volume. Line-of-business HTAs published from a file share or intranet site match on every open, and in an estate still shipping HTA front-ends that is the dominant source by a wide margin — which is why the rule is medium, not high. Behind it: vendor installers and OEM support tools with bundled HTAs on a share, and setup wrappers calling the documented mshta.exe vbscript:Close(...) idiom, which is byte-identical to the inline arm. The parent arm adds help-desk scripts driven from WSH and internal macro-enabled workbooks opening their own HTA form.

05 · Detection maturity

tier_1: , and it stays there until it has been run against real data. Nothing here has touched a log line; the reasoning above is analysis, not verification, and it says nothing about the volume underneath.
tier_2: run read-only, rank hits by `ParentImage` and HTA path, and build the allowlist.
tier_3: ** add the AN1397 network and file legs as companion rules and alert on the correlation, so a hit means proxied execution rather than an HTA that opened.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/0c5fdea0-050b-49f2-ac6e-a69476df4ed1

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Mshta launching remote or inline script content

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it