Mshta HTA Application Delivered via HTTP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects the delivery of an HTA (HTML Application) file via HTTP. It specifically looks for HTTP responses containing a URI with the '.hta' extension (case-insensitive) and the content '<HTA:APPLICATION' (case-insensitive) within the file data, indicating an HTA application being served to a client. This technique is often used by attackers for defense evasion and initial access.