Skip to content
skopnix
Detections · Rule
← Sigma detectionsSigma · Behaviour (ATT&CK technique)

mshta executing remote or inline script (T1218.005)

SIGhighconfidence 80/100generated 2026-10-18

mshta.exe launched with an http(s) URL or an inline javascript: / vbscript: handler — a signed-binary proxy for script payloads. Observed for: APT29, APT32, Confucius, Earth Lusca, Gamaredon Group, GOLD CABIN and 7 more.

ATT&CK
T1218.005 mitre ↗
Linked actors
APT29 · APT32 · Confucius · Earth Lusca · Gamaredon Group · GOLD CABIN · Inception Framework · Kimsuky · LazyScripter · MuddyWater · RAZOR TIGER · SideCopy · TA2541
False positives
Local .hta files without a URL or inline script handler do not match.

Sigma rule

skopnix-sigma-ttp-t1218-005-05b78d0f.ymldownload .yml ↓
title: Skopnix - mshta executing remote or inline script (T1218.005)
id: 8187b70a-f7a6-5f87-a6ae-56b244b4c1cd
status: experimental
description: 'mshta.exe launched with an http(s) URL or an inline javascript: / vbscript: handler — a signed-binary proxy for script payloads. Observed for: APT29, APT32, Confucius, Earth Lusca, Gamaredon Group, GOLD CABIN and 7 more.'
references:
  - https://attack.mitre.org/techniques/T1218/005/
  - https://skopnix.com/actors/apt29
  - https://skopnix.com/actors/apt32
  - https://skopnix.com/actors/confucius
  - https://skopnix.com/actors/earth-lusca
  - https://skopnix.com/actors/gamaredon-group
  - https://skopnix.com/actors/gold-cabin
  - https://skopnix.com/actors/inception-framework
  - https://skopnix.com/actors/kimsuky
  - https://skopnix.com/actors/lazyscripter
  - https://skopnix.com/actors/muddywater
author: skopnix
date: '2026-10-18'
tags:
  - attack.stealth
  - attack.t1218.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \mshta.exe
  selection_cli:
    CommandLine|contains:
      - http://
      - https://
      - 'javascript:'
      - 'vbscript:'
  condition: all of selection_*
falsepositives:
  - Legacy line-of-business HTA applications served from an intranet URL (whitelist the URL)
level: high

How to deploy on Sigma

  1. 1.Convert for your SIEM with sigma-cli / pySigma, e.g. sigma convert -t splunk -p sysmon rule.yml.
  2. 2.Run it as a hunt first: every rule ships as status experimental.
  3. 3.Promote to an alert once a week of results is clean on your data.

Check · The processing pipeline must map the logsource (firewall, dns, proxy, webserver, process_creation) to your field names.

References