Mshtml.dll

Invoke an HTML Application via mshta.exe (note: pops a security warning and a print dialogue box).

Use Launch an HTA application.

rundll32.exe Mshtml.dll,PrintHTML {PATH_ABSOLUTE:.hta}

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1218.011

Detection

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml

Refs

twitter.com/pabraeken/status/998567549670477824

windows10dll.nirsoft.net/mshtml_dll.html

lolbas-project.github.io/lolbas/Libraries/Mshtml/