mshta.exe Remote Script Execution via HTTP or VBScript (T1218.005)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•1

Detects the execution of mshta.exe with arguments containing URLs, script languages (vbscript, javascript), or .hta file extensions, which is a common technique used by attackers to execute malicious code via a legitimate Windows utility.