ATT&CK T1218 - MSHTA Scriptlet Download

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects HTTP traffic where the URI contains ".sct" (scriptlet) in a case-insensitive manner. This is indicative of an attempt to download a scriptlet, which can be used by MSHTA (Microsoft HTML Application host) for defense evasion, often to execute malicious code.