Mshta.exe Remote Script Execution via HTTP/VBScript/JavaScript

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects execution of mshta.exe with command line arguments containing web-related indicators (http) or scripting engines (vbscript, javascript). This behavior is characteristic of adversaries using mshta.exe as a proxy to execute remote malicious payloads or inline scripts, effectively bypassing application controls and browser security contexts.