Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1218.005

Mshta

Stealth 49 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
elastic Unusual Network Activity from a Windows System Binary production 2026-10-19
splunk Detect mshta inline hta execution production 2026-10-09
splunk Detect Rundll32 Inline HTA Execution production 2026-10-09
elastic Suspicious Windows Command Shell Arguments production 2026-10-09
elastic Script Execution via Microsoft HTML Application production 2026-10-09
elastic Suspicious Microsoft HTML Application Child Process production 2026-10-09
splunk Suspicious mshta child process production 2026-10-09
elastic Potential ClickFix Command via Windows Run Dialog production 2026-10-05
elastic Potential FileFix Command via Windows Explorer Address Bar production 2026-10-05
splunk Detect MSHTA Url in Command Line production 2026-10-02
elastic Potential Execution via FileFix Phishing Attack production 2026-09-28
splunk Detect mshta renamed deprecated 2026-09-23
splunk Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI production 2026-09-22
splunk Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download production 2026-09-22
elastic Suspicious JetBrains TeamCity Child Process production 2026-09-18
elastic Suspicious Execution from VS Code Extension production 2026-09-18
elastic Suspicious MS Office Child Process production 2026-09-18
elastic Suspicious Explorer Child Process production 2026-09-18
elastic Incoming DCOM Lateral Movement via MSHTA production 2026-09-18
elastic Execution of Persistent Suspicious Program production 2026-09-18
elastic Service Control Spawned via Script Interpreter production 2026-09-18
elastic Suspicious MS Outlook Child Process production 2026-09-18
elastic Suspicious ScreenConnect Client Child Process production 2026-09-18
elastic Suspicious .NET Code Compilation production 2026-09-18
elastic Microsoft Build Engine Started by a Script Process production 2026-09-18
elastic Mshta Making Network Connections production 2026-09-18
elastic Suspicious Execution from a Mounted Device production 2026-09-18
elastic Suspicious Managed Code Hosting Process production 2026-09-18
elastic Delayed Execution via Ping production 2026-09-18
elastic Execution from Unusual Directory - Command Line production 2026-09-18
elastic Command and Scripting Interpreter via Windows Scripts production 2026-09-18
elastic Suspicious PDF Reader Child Process production 2026-09-18
elastic Process Activity via Compiled HTML File production 2026-09-18
elastic Potential Fake CAPTCHA Phishing Attack production 2026-09-18
elastic Execution of a Downloaded Windows Script production 2026-09-18
splunk Windows Mshta Execution In Registry production 2026-07-20
splunk Windows Process Writing File to World Writable Path production 2026-05-13
splunk Windows MSHTA Writing to World Writable Path production 2026-05-13
splunk Suspicious mshta spawn production 2026-05-13
splunk Mshta spawning Rundll32 OR Regsvr32 Process production 2026-05-13
sigma Csc.EXE Execution Form Potentially Suspicious Parent test 2026-03-23
sigma MSHTA Execution with Suspicious File Extensions test 2025-05-12
sigma HackTool - CACTUSTORCH Remote Thread Creation test 2023-05-05
sigma Potential Baby Shark Malware Activity test 2023-03-08
sigma Potential LethalHTA Technique Execution test 2023-02-07
sigma Suspicious JavaScript Execution Via Mshta.EXE test 2023-02-07
sigma Suspicious MSHTA Child Process test 2023-02-06
sigma Remotely Hosted HTA File Executed Via Mshta.EXE test 2023-02-06
elastic Network Connection via Mshta deprecated 2020-10-30