Procedure examples

APT38 has used a renamed version of `mshta.exe` to execute malicious HTML files.

SideCopy has utilized `mshta.exe` to execute a malicious hta file.

Kimsuky has used mshta.exe to run malicious scripts on the system.

APT32 has used mshta.exe for code execution.

MuddyWater has used mshta.exe to execute its POWERSTATS payload and to pass a PowerShell one-liner for execution.

Gamaredon Group has used `mshta.exe` to execute malicious files.

FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.

Sidewinder has used mshta.exe to execute malicious payloads.

Mustang Panda has used mshta.exe to launch collection scripts.

TA2541 has used `mshta` to execute scripts including VBS.

Confucius has used mshta.exe to execute malicious VBScript.

APT29 has use `mshta` to execute malicious scripts on a compromised host.

TA551 has used mshta.exe to execute malicious payloads.

LazyScripter has used `mshta.exe` to execute Koadic stagers.

Lazarus Group has used mshta.exe to execute HTML pages downloaded by initial access documents.

Earth Lusca has used `mshta.exe` to load an HTA script within a malicious .LNK file.

Inception has used malicious HTA files to drop and execute malware.