MSHTA Inline Script or Remote HTA Execution via mshta.exe

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•0

Detects the execution of mshta.exe with suspicious command-line arguments that indicate the loading of inline JavaScript/VBScript or the retrieval of remote HTA files via HTTP/HTTPS. This behavior is a common technique used by attackers to proxy execution through a trusted Windows binary, often to bypass security controls.