Detection of Malicious mshta.exe Inline Protocol Execution

The Microsoft HTML Application (MSHTA) utility is a legitimate Windows component designed to execute .hta files. However, it is frequently abused by threat actors as a Living off the Land (LotL) technique to execute malicious code. By invoking mshta.exe with inline protocol handlers such as JavaScript, VBScript, or 'about:', attackers can execute arbitrary code directly from the command line or via downloaded scripts without dropping files on disk. This activity is a common vector for deploying various malware strains, including Gozi, XWorm, and stealer-type payloads, to facilitate privilege escalation, persistence, or data exfiltration. Defenders must monitor process execution telemetry for command-line arguments that utilize these protocol handlers to identify and interrupt unauthorized script execution.

Impact

Successful exploitation of this technique allows attackers to evade signature-based endpoint security, execute malicious code within the context of a trusted Windows process, and establish persistence. This technique has been observed in campaigns involving various malware families, including Gozi, XWorm, Rustonotto, and BlankGrabber. Failure to detect this activity can lead to full system compromise and significant data loss within an enterprise environment.

Recommendation

Prioritize the identification of mshta.exe execution patterns in EDR telemetry to detect unauthorized script execution.

• Deploy the provided Sigma rule to your SIEM/EDR platform to alert on suspicious command-line patterns.
• Enable Sysmon (Event ID 1) or Windows Security Log (Event ID 4688) on all Windows endpoints to ensure process creation logging includes full command-line arguments.
• Use the Splunk Common Information Model (CIM) to normalize process data to ensure detection coverage across the environment.
• Investigate any mshta.exe processes spawning from suspicious parent processes or containing unusual inline command arguments.