InstallFix Uses mshta to Retrieve a Remote Script

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•1•0•5

Detects mshta executing a remote HTA, JavaScript, or HTML resource from a browser-driven installation chain. This rule specifically looks for mshta.exe being executed with a command line containing a URL (http/https) or script protocol (javascript/vbscript) followed by file extensions or keywords commonly associated with malicious scripts or payloads (.hta, .js, .html, payload, install).