Skip to content
Threat Feed
Subscribe

Tag

Mshtml

1 brief RSS
high advisory

Suspicious MSHTML/MSHTA Network Execution Without Direct URL

This analytic detects the anomalous execution of mshta.exe or rundll32.exe invoking mshtml.dll without a direct HTTP/HTTPS URL in the command line, potentially indicating obfuscated script execution by threat actors for initial access or payload staging while evading static detections.

Windows mshta mshtml rundll32 lolbas defense-evasion initial-access network-execution
2r 2t