LOLBin Mshta
This query detects the use of mshta.exe.
CQL · Falcon Next-Gen SIEMCopy query
in(#event_simpleName, values=["ProcessRollup2","ProcessBlocked"])
| event_platform=Win and ImageFileName=/mshta.exe/i
| CommandLine=/mshta(?:\.exe)?\"?\s+\"?(?<HtaPath>(?:.*?\.hta|(?=\").*?(?=\")|.*?(?=(?:\s|$))))/i
| HtaPath=/(?<HtaFolder>.*)(\\\\|\/)/i
| HtaPath=/(.*(\\\\|\/))?(?<HtaFile>.*)$/iMshta.exe – A Windows utility for executing HTML Applications (.hta) — often abused to run embedded or remote VBScript, JScript, or download-and-execute payloads via alternate data streams or web URLs.
LOLBin_Mshta.yml
T1218.005, T1105
ByteRay GmbH
Hunting
Endpoint
Insight
2025-08-06
2025-08-26
