MSHTA Execution via Explorer

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects MSHTA.exe execution spawned by explorer.exe, which could indicate malicious activity. MSHTA.exe is a utility that executes Microsoft HTML Applications (HTA) files. While legitimate in the past, its usage in modern environments is rare and often associated with malicious activities. Attackers frequently abuse MSHTA.exe to execute malicious scripts and bypass application allowlisting. It is commonly used to download and execute remote payloads. Nowadays, it has been commonly observed being executed through LNK files or ClickFix campaigns, making it easier for attackers to deliver and run malicious payloads with minimal user interaction.

2025-05-07 00:00:00

None

2689ce2d-4f91-4682-a9f3-82c6a31261d6

attack.execution attack.t1218.005 attack.initial-access

Nextron Sigma feed only (private)