BIOC
Informational
✕
Microsoft HTML Application Host spawns from Explorer.exe
Mshta allows execution of .hta files, an attacker can use mshta to execute malicious hta files on the victim's host.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Evasion
- Status:
- Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: System Binary Proxy Execution: Compiled HTML File (T1218.001)
Indicator:
Process action type = execution AND target process name = mshta.exe Process initiated by = explorer.exe , cgo name = explorer.exe , os parent name = explorer.exe Host host os = windows
Preventable: yes