MSHTA LOLBin: Remote Script or Inline VBScript/JScript Execution

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects the abuse of the Windows utility mshta.exe to execute potentially malicious scripts or remote HTML applications (HTA). The rule looks for command-line arguments involving remote URL fetches (HTTP/HTTPS/UNC) or inline script execution (vbscript/javascript), which are common techniques for bypassing security controls and executing payloads.