HTA VBScript Persistence via HKCU Run Key MyApp Launching mshta.exe

Duo Tech@duotech

•updated Jul 16, 2026•1•0•4

Detects the creation or modification of a registry run key entry that configures 'mshta.exe' to launch an HTA file, potentially from a remote URL. This technique is used for persistence and to proxy execution of malicious scripts via the legitimate mshta.exe utility.