attack.t1218.005

Csc.EXE Execution Form Potentially Suspicious Parent

Sep 3, 2026 · attack.execution attack.stealth attack.t1059.005 attack.t1059.007 attack.t1218.005 attack.t1027.004 ·

Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.

Remotely Hosted HTA File Executed Via Mshta.EXE

Sep 3, 2026 · attack.execution attack.stealth attack.t1218.005 ·

Detects execution of the "mshta" utility with an argument containing the "http" keyword, which could indicate that an attacker is executing a remotely hosted malicious hta file

Suspicious JavaScript Execution Via Mshta.EXE

Sep 3, 2026 · attack.stealth attack.t1218.005 ·

Share on:

Detects execution of javascript code using "mshta.exe".

HackTool - CACTUSTORCH Remote Thread Creation

Apr 28, 2026 · attack.privilege-escalation attack.execution attack.stealth attack.t1055.012 attack.t1059.005 attack.t1059.007 attack.t1218.005 ·

Share on:

Detects remote thread creation from CACTUSTORCH as described in references.

MSHTA Execution with Suspicious File Extensions

Apr 28, 2026 · attack.stealth attack.t1140 attack.t1218.005 attack.execution attack.t1059.007 cve.2020-1599 ·

Share on:

Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content, such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.

Potential Baby Shark Malware Activity

Apr 28, 2026 · attack.execution attack.discovery attack.stealth attack.t1012 attack.t1059.003 attack.t1059.001 attack.t1218.005 detection.emerging-threats ·

Share on:

Detects activity that could be related to Baby Shark malware

Potential LethalHTA Technique Execution

Apr 28, 2026 · attack.stealth attack.t1218.005 ·

Share on:

Detects potential LethalHTA technique where the "mshta.exe" is spawned by an "svchost.exe" process

Suspicious MSHTA Child Process

Apr 28, 2026 · attack.stealth attack.t1218.005 car.2013-02-003 car.2013-03-001 car.2014-04-003 ·

Share on:

Detects a suspicious process spawning from an "mshta.exe" process, which could be indicative of a malicious HTA script execution