MSHTA Remote HTA Script Execution via URL or Inline Script

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•0

Detects the execution of mshta.exe with arguments that indicate the loading of remote HTML applications (HTA) via HTTP/HTTPS, UNC paths, or the execution of inline JavaScript/VBScript commands. This behavior is a common technique used by attackers to proxy execution through a trusted Windows binary to bypass security controls or fetch malicious payloads.