MSHTA HTA Application Download

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects the download of an HTML Application (HTA) file that contains the string "<HTA:APPLICATION". HTA files can be used to execute malicious code, often bypassing browser security restrictions. The rule specifically looks for HTTP traffic where the URI contains ".hta" and the file data contains the HTA application tag, indicating a potential attempt to deliver or execute a malicious HTA.