Suspicious Mshta HTTP Call to Non-RFC1918 Dot-Quad or Hex-Encoded IPv4 Address

Marcus Mingo@meeengoh

•updated Dec 1, 2025•5•1•54

Detects mshta execution where an HTTP/HTTPS URL targets a host expressed as a dot-quad IPv4 address or hex-encoded IPv4 address, excluding RFC1918 private address ranges. Threat actors frequently use raw or hex-encoded IP literals to evade domain filtering and deliver malicious HTA payloads.