Mshtml.dll

Commands

1. ExecuteUser T1218.011

   Launch an HTA application.

   rundll32.exe Mshtml.dll,PrintHTML {PATH_ABSOLUTE:.hta}

   Invoke an HTML Application via mshta.exe (note: pops a security warning and a print dialogue box).

   os: Windows 10, Windows 11

   Execute: HTA

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml

Resources

• https://twitter.com/pabraeken/status/998567549670477824
• https://windows10dll.nirsoft.net/mshtml_dll.html