Skip to content
skopnix
Detections · Rule
← Cortex XDR detectionsCortex XDR · Behaviour (ATT&CK technique)

mshta executing remote or inline script (T1218.005)

XQLhighconfidence 80/100generated 2026-10-18

mshta.exe launched with an http(s) URL or an inline javascript: / vbscript: handler — a signed-binary proxy for script payloads. Observed for: APT29, APT32, Confucius, Earth Lusca, Gamaredon Group, GOLD CABIN and 7 more.

ATT&CK
T1218.005 mitre ↗
Correlation
set the rule's MITRE tactic to TA0005 and technique to T1218.005
Linked actors
APT29 · APT32 · Confucius · Earth Lusca · Gamaredon Group · GOLD CABIN · Inception Framework · Kimsuky · LazyScripter · MuddyWater · RAZOR TIGER · SideCopy · TA2541
False positives
Local .hta files without a URL or inline script handler do not match.

XQL query

skopnix-cortex-ttp-t1218-005-7d211a07.xqldownload .xql ↓
dataset = xdr_data
| filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter lowercase(action_process_image_name) = "mshta.exe" and (lowercase(action_process_image_command_line) contains "http://" or lowercase(action_process_image_command_line) contains "https://" or lowercase(action_process_image_command_line) contains "javascript:" or lowercase(action_process_image_command_line) contains "vbscript:")
| fields _time, agent_hostname, actor_effective_username, action_process_image_name, action_process_image_command_line, actor_process_image_name, causality_actor_process_image_name
| sort desc _time

How to deploy on Cortex XDR

  1. 1.Paste the XQL into Incident Response > Investigation > Query Builder > XQL Search.
  2. 2.To alert, save it as a Correlation Rule and set the MITRE tactic and technique printed with the rule.
  3. 3.Schedule it on the interval you hunt at; keep the fields stage for the alert's columns.

Check · CVE rules read PAN-OS URL logs (panw_ngfw_url_raw), which need the NGFW integration and, for HTTPS, decryption.

References