T1218.005 Signed Binary Proxy Execution: Mshta - Mshta Abuse - Consolidated Detection

Matt Swann@Mcswann

•updated Aug 13, 2026•0•0•4

A consolidated detection query that seeks to identify potentially malicious usage of mshta.exe, a known LOLBin commonly abused by threat actors to proxy code execution. This detection breaks down potentially suspicious mshta.exe usage into a number of categories and displays which category the query hits on in the resultant data. Note that this may require initial tuning to tune out known environment usage of mshta.exe - line 23 exists as a placeholder to add known exceptions.