Mshta
Subtechnique · ATTACK:enterprise:T1218.005
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1218.005",
"title": "Mshta",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1218/005",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--840a987a-99bd-4a80-a5c9-0cb2baa6cade",
"external_id": "T1218.005",
"domain": "enterprise",
"created": "2020-01-23T19:32:49.557Z",
"modified": "2026-05-12T15:12:00.676Z",
"version": "3.0",
"aliases": [
],
"tactics": [
"stealth"
],
"source_references": [
{
"source_name": "FireEye Attacks Leveraging HTA",
"url": "https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html"
},
{
"source_name": "FireEye FIN7 April 2017",
"url": "https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"
},
{
"source_name": "Airbus Security Kovter Analysis",
"url": "https://airbus-cyber-security.com/fileless-malware-behavioural-analysis-kovter-persistence/"
},
{
"source_name": "Cylance Dust Storm",
"url": "https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"
},
{
"source_name": "LOLBAS Mshta",
"url": "https://lolbas-project.github.io/lolbas/Binaries/Mshta/"
},
{
"source_name": "Red Canary HTA Abuse Part Deux",
"url": "https://www.redcanary.com/blog/microsoft-html-application-hta-abuse-part-deux/"
},
{
"source_name": "MSDN HTML Applications",
"url": "https://msdn.microsoft.com/library/ms536471.aspx"
},
{
"source_name": "Wikipedia HTML Application",
"url": "https://en.wikipedia.org/wiki/HTML_Application"
}
]
}Explicit source assertions (33)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:T1218.005 → subtechnique-of → ATTACK:enterprise:T1218
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c29bffb-78c0-43c0-8b99-f5155bfa0432
ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ecbbfa3-6b81-4cf7-9033-373ebbc2832f
Rewterz Sidewinder APT April 2020 · Rewterz Sidewinder COVID-19 June 2020ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--12c617b6-9c95-46fd-a3ef-845be82ac237
Lazarus APT January 2022 · Qualys LolZarusATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1567d198-b2b9-4eda-a2e2-ba5dd4e51547
MalwareBytes LazyScripter Feb 2021 · Github KoadicATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1837a0e7-d8aa-4c96-8213-7d08ceb86390
Microsoft WDACATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1923bc58-a830-457d-810f-27091e032f46
FireEye MuddyWater Mar 2018 · Securelist MuddyWater Oct 2018ATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2ed3ed76-7ebe-4371-a7e9-cc5a45ace915
Unit42 Xbash Sept 2018ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--36838da3-5543-4998-b125-0a50d31d288e
Secureworks BRONZE PRESIDENT December 2019ATTACK:enterprise:S0414 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3759c775-300f-4981-9264-722ecf97aa64
CISA AA20-301A KimsukyATTACK:enterprise:G0140 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3766cf55-568a-410f-8968-7a4adac96f77
MalwareBytes LazyScripter Feb 2021ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3cd0e385-3c60-4742-b3a6-c07dbf10ba45
FireEye MuddyWater Mar 2018ATTACK:enterprise:G1018 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4bd79a52-d28c-4880-9f10-dda500ac40c9
Cisco Operation Layover September 2021ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5a9ef207-3a5b-47c0-9ffb-938966295700
Netskope LummaStealer 2025 · Qualys LummaStealer 2024ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6f6b7e76-fed9-4827-a038-52948105db3d
1 - appvATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7643698c-2dc4-43ca-9d90-c656962dfecb
FireEye Metamorfo Apr 2018ATTACK:enterprise:G0100 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--864fdbd1-99fe-4036-a296-241c53337d85
Kaspersky Cloud Atlas August 2019ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--90f03f42-a2f1-4fab-8a10-ebbbbc4fba19
EST Kimsuky April 2019 · CISA AA20-301A Kimsuky · Crowdstrike GTR2020 Mar 2020 · KISA Operation Muzabi · Aryaka Kimsuky July 2025ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--98afbb05-d48e-4438-add6-df3ea9fb568c
ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9e77b81d-6298-4233-8baa-f419031a9d64
FireEye FIN7 April 2017ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f99cba5-2fb2-4750-aca4-3d4a0a872685
Cofense RevengeRAT Feb 2019ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a3627d9d-1c78-4b10-8b1c-3183a939862b
TrendMicro EarthLusca 2022ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a7f5320a-dd76-4fa0-998f-44860ff1b307
Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017ATTACK:enterprise:S0228 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aaca809f-576c-4875-a09d-5a46a5e5e422
fsecure NanHaiShu July 2016ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--acd4b81e-6bef-4ac0-bf4b-2428b5c9c6b9
MSTIC NOBELIUM Mar 2021ATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b00d5e69-736f-47b9-befd-f5593550ad11
Cylance Dust StormATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b8fdee05-cbe2-43b1-a224-e4b019017c3e
ESET T3 Threat Report 2021ATTACK:enterprise:G0142 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bcb09da2-4ef9-4739-b36d-96c9c62ec4e2
TrendMicro Confucius APT Feb 2018ATTACK:enterprise:S1155 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cc6ec5e1-19ac-44b5-9056-79893cef3a15
Github CovenantATTACK:enterprise:S0147 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d4e67bb3-dcb2-4427-a48e-d8b4bcc35afa
Symantec Shuckworm January 2022ATTACK:enterprise:G0127 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--df33a65c-1529-4f8d-a27b-0d00f540e6e6
Unit 42 TA551 Jan 2021ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ebfa4596-86bb-4a7f-a6f5-11a5642b31fd
MalwareBytes SideCopy Dec 2021ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f76be4ac-f342-4904-b50d-06e28b878011
ESET Gamaredon Sept2024 · Symantec Shuckworm January 2022 · SymantecCarbonBlack_ShuckwormUSB_Apr2025 · unit42_gamaredon_dec2022ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff9fad0d-7481-4804-a4e8-800265a5c17d
DFIR Conti Bazar Nov 2021