MSHTA.exe executes remote HTA payload via HTTP(S) URL

ᴅᴜᴛᴄʜʙᴏʏ 😎@dutchboy

•updated Jul 17, 2026•6•0•11

Detects the execution of mshta.exe with a remote URL containing an .hta file in the command line. This pattern is commonly used by adversaries to proxy execution of malicious scripts via a trusted Windows binary, often initiated by common applications like explorer.exe or cmd.exe.