mshta.exe is a legitimate Microsoft-signed Windows binary that executes HTML Applications (HTA files). Per MITRE ATT&CK technique T1218.005, attackers abuse mshta.exe as a Living-off-the-Land Binary (LOLBin) to run malicious VBScript or JScript, bypass application whitelisting, and proxy payload execution. Because mshta.exe is signed by Microsoft and present on every Windows installation, it's trusted by most security controls by default.
Key takeaways
- mshta.exe is a legitimate Windows binary for running HTML Applications (HTA files).
- Per MITRE ATT&CK T1218.005, it's widely abused as a LOLBin for malicious script execution.
- HTA files run outside the browser sandbox with full user permissions.
- Block via AppLocker or WDAC. Monitor for suspicious child processes and network connections.
- Used by APT groups including Kimsuky, MuddyWater, and FIN7, per MITRE ATT&CK.
Quick explanation
In simple terms
mshta.exe is a Windows program that runs HTML-based scripts. Attackers abuse it because it's trusted by Windows security tools and can execute malicious code without triggering alerts.
Technical definition
mshta.exe (Microsoft HTML Application Host) is a Windows PE executable that hosts the MSHTML rendering engine and Windows Script Host to execute HTA files containing VBScript or JScript. Per MITRE ATT&CK T1218.005, it's classified as a signed binary proxy execution technique.
Analogy
mshta.exe is like a master key that was designed for building maintenance but can also be used by burglars. It's a legitimate tool that opens doors (runs scripts), but in the wrong hands, it provides access to everything.
Definition
mshta.exe is a Microsoft-signed Windows binary that executes HTML Applications (HTA files). Per MITRE ATT&CK T1218.005, attackers abuse it as a LOLBin to run malicious scripts, bypass application whitelisting, and proxy payload execution.
mshta.exe (Microsoft HTML Application Host) is a Windows executable located at C:\Windows\System32\mshta.exe. It executes HTML Application (.hta) files, which are HTML documents that run with the trust level of a fully trusted application rather than in the browser sandbox.
Per MITRE ATT&CK technique T1218.005, mshta.exe is one of the most commonly abused Living-off-the-Land Binaries (LOLBins) in cyber attacks. Attackers use it for initial access, defense evasion, and execution because it's Microsoft-signed, present on every Windows system, and can execute VBScript or JScript from local files, remote URLs, or inline command-line arguments.
Why it matters
Core concepts
LOLBin (Living-off-the-Land Binary)
A legitimate, Microsoft-signed system binary that attackers repurpose for malicious activity because it's trusted by default.
Living-off-the-Land Binaries are pre-installed Windows executables that attackers use instead of dropping custom malware. Because they're signed by Microsoft, they bypass many security controls including application whitelisting. Per MITRE ATT&CK, LOLBin abuse is a key technique in the 'Defense Evasion' tactic.
Example
mshta.exe, certutil.exe, rundll32.exe, regsvr32.exe, and wmic.exe are all commonly abused LOLBins.
Why it matters — LOLBins let attackers execute malicious code using trusted system tools, evading detection by traditional antivirus and application control policies.
MITRE ATT&CK T1218.005
The MITRE ATT&CK technique ID for 'Signed Binary Proxy Execution: Mshta' describing how attackers abuse mshta.exe.
MITRE ATT&CK documents mshta.exe abuse under T1218.005. The technique covers three variants: executing local HTA files, executing remote HTA files via URL, and executing inline VBScript/JScript via command-line arguments.
Example
APT groups including Kimsuky and MuddyWater have used mshta.exe for initial access, per MITRE ATT&CK.
Why it matters — T1218.005 provides detection guidance and maps real-world threat actor usage, helping security teams build specific detection rules.
How it works
mshta.exe is invoked
A user opens an .hta file or an attacker invokes mshta.exe from the command line with inline script or a URL. Example: mshta vbscript:Execute("...").
User/Attacker → mshta.exe
Script execution outside the browser sandbox
mshta.exe parses the HTA content and executes embedded VBScript or JScript with full user-level permissions. HTA files run outside the browser sandbox, unlike regular web pages.
mshta.exe → Script engine
System interaction
The script can interact with the local system: download files, create processes, modify the registry, access COM objects, and establish network connections.
Script → System access
Benefits
Legitimate use: interactive HTML-based admin tools
HTA files can create rich UI dialogs and interact with the local system using VBScript or JScript, without requiring compiled executables.
Legacy enterprise applications
Legacy enterprise admin tools and installer wizards use HTA files for custom UI during software deployment.
Limitations
Trusted by default on all Windows systems
Highmshta.exe is present on every Windows installation and signed by Microsoft. Standard antivirus doesn't flag its execution because it's a legitimate system binary.
Workaround — Block via AppLocker, WDAC, or endpoint detection rules. Microsoft Defender for Endpoint detects known mshta.exe abuse patterns.
Legacy application dependencies prevent blocking
MediumSome legacy enterprise applications, installer wizards, and admin tools still depend on HTA files, making blanket blocking impossible without assessment.
Workaround — Audit HTA file usage with process monitoring before blocking. Restrict mshta.exe to specific directories if full blocking isn't possible.
Examples
Phishing with HTA attachment
An attacker sends a phishing email containing a .hta attachment that, when opened, executes VBScript to download a reverse shell.
Per MITRE ATT&CK, the attacker sends a phishing email with an HTA file attachment or a link to a remote HTA. When the user opens it, mshta.exe executes the embedded VBScript, which downloads and runs the actual malware payload.
Comparisons
mshta.exe vs. rundll32.exe
mshta.exe vs. PowerShell
Myths, corrected
Myth
mshta.exe is malware and should be deleted
Correction
mshta.exe is a legitimate Windows component. Deleting it may break Windows functionality. The binary itself isn't malicious; it's abused by attackers. The correct response is to block its execution via policy, not delete the file.
Why it happens: Security tools flag mshta.exe activity as malicious, leading to the assumption that the binary itself is malware.
Myth
Blocking mshta.exe breaks Windows
Correction
For most modern environments, blocking mshta.exe via AppLocker or WDAC causes no issues. HTA files are rarely used in modern applications. Test in audit mode first to identify any dependencies.
Why it happens: Admins fear breaking system functionality by blocking any Windows-signed binary.
Practical implications
For admins
Audit mshta.exe usage in your environment. Block via AppLocker or WDAC if no HTA dependencies exist. Configure Sysmon Event ID 1 to log mshta.exe process creation.
For MSPs
Include mshta.exe blocking in your standard endpoint hardening baseline. Monitor for mshta.exe in EDR telemetry across client environments.
For security
Create SIEM detection rules for: mshta.exe with URL arguments, mshta.exe spawning cmd.exe or powershell.exe, and mshta.exe making outbound network connections. Per MITRE, these are the primary abuse patterns.
Decision guide
Use when
- Legacy enterprise applications require HTA files (rare in modern environments).
- Custom installer wizards use HTA for UI during deployment.
Alternatives
- PowerShell for scripted administration (better logged and controlled)
- Compiled executables for custom admin tools
- Web applications for interactive admin interfaces
Related terms
LOLBin
A legitimate, pre-installed system binary abused by attackers for malicious purposes.
HTA
HTML Application, a file format that runs HTML with VBScript/JScript outside the browser sandbox.
A knowledge base of adversary tactics and techniques, including T1218.005 for mshta.exe.
Frequently asked questions
What is mshta.exe?
mshta.exe is the Microsoft HTML Application Host. It executes .hta files, which are HTML files that run with the permissions of a fully trusted application, including access to VBScript and JScript for system interaction.
Why do attackers use mshta.exe?
Per MITRE ATT&CK T1218.005, attackers use mshta.exe to run malicious VBScript/JScript because it's a Microsoft-signed binary that bypasses application whitelisting by default.
How do I block mshta.exe?
Block mshta.exe execution via AppLocker or Windows Defender Application Control (WDAC). If blocking isn't possible, create SIEM alerts for mshta.exe spawning cmd.exe, powershell.exe, or making network connections.
Where is mshta.exe located?
mshta.exe is located at C:\Windows\System32\mshta.exe (and C:\Windows\SysWOW64\mshta.exe on 64-bit systems). It's a legitimate Windows component, not malware itself.
Is mshta.exe safe to block?
Yes, but it's rarely needed in modern environments. Most legitimate HTA usage is in legacy enterprise admin tools. Block it unless you have confirmed HTA dependencies.
Conclusion
mshta.exe is a legitimate Windows binary for running HTML Applications, but it's widely abused as a LOLBin for initial access and execution. Per MITRE ATT&CK T1218.005, attackers use it to run inline VBScript, download remote HTA payloads, and bypass application whitelisting.
Per CISA and MITRE, defense requires blocking mshta.exe via AppLocker or WDAC where HTA files aren't needed, monitoring for suspicious child processes (cmd.exe, powershell.exe), and alerting on mshta.exe making outbound network connections.
Main takeaway
Explore other LOLBins (certutil.exe, regsvr32.exe, wmic.exe) and the LOLBAS Project for a complete catalog of abused Windows binaries.
