mshta.exe used to execute malicious file from internet

Salten Fisk@saltenfisk

•updated Jul 10, 2025•3•2•38

Detects mshta.exe executing with command-line arguments containing 'http', which is indicative of mshta.exe being used to download and execute remote HTA files or scripts. This procedure is known to be used in ClickFix attacks where threat actors use fake Captcha portals to download malware payloads.