Malicious HTA File Execution by MSHTA

ravi vaghasiya@ravivaghasiya

•updated Aug 1, 2025•3•1•91

Detects the execution of mshta.exe spawning a command shell (cmd.exe) to download a remote file. This behavior is indicative of malicious HTA files used to deliver malware, as seen in campaigns distributing Epsilon Red ransomware.