mshta 开源项目推荐（15 个）

gnh1201 /welsonjs

WelsonJS - Built-in JavaScript for Industrial Automation on Windows

ildar-shaimordanov /my-scripts

set of my scripts

AHMUJia /claude-chatmap

A local, zero-install dashboard for Claude Code chats - grouped by folder, size at a glance, double-click to resume in a WispTerm tab.

datadiode /cehta

HTML Application host for Windows CE

otnc /captcha-like-fake-captcha

ReCAPTCHAに扮した偽ReCAPTCHA風のCaptchaのサンプルです。HTML Applicationとmshtaコマンドを使用しているので、アクセスするユーザーがWindows以外ではおそらく動作しません。安全です。

gnh1201 /yaww

YAWW (Yet Another Windows WebView) - WebView for Windows, with WebView2, EdgeHTML, MSHTML, and ChakraCore.

akuafif /HTA-Map-Network-Printer

HTA (vbscript) for Mapping Network Printer

Rednexie /RSPG

Random Strong Password Generator with HTA/VBS

Modern-IE /IE-Engine-Bridge

A lightweight C-based utility to launch a standalone Internet Explorer-powered browser interface via HTA, bypassing Microsoft Edge redirection on modern Windows 10/11.

Tam-George10 /Ransomware-Detection-Engineering

A detection engineering repository simulating a real ransomware intrusion using Sysmon logs and Sigma rules. Includes coverage for mshta execution, netcat reverse shells, PowerShell enumeration, service modification, RunOnce registry persistence, data exfiltration, and encryption activity.

seb1k /block-mshta-with-intune

Block outbound connections from mshta.exe using Microsoft Intune Firewall Rules

OsmanDhaqane /living-off-the-land-attacks-tryhackme

TryHackMe walkthrough focused on detecting Living Off the Land activity using trusted Windows tools, SIEM alerts, and command-line analysis.

yev-cyber /dfir-malware-investigation

Sanitized DFIR case study of a fake CAPTCHA malware delivery chain involving mshta, obfuscated PowerShell, LOTL behavior, IOC analysis, and remediation actions.

malcorex /Real-World-Malware-Analysis

Technical analysis of a real-world HTA downloader sample, including behavioral analysis, execution flow, IoCs, detection opportunities, and defensive recommendations.

mercwar /dc2url

dc2url uses windows api handles for HTTP requests to go along with other popular programs like curl, powershell, bitsadmin, certutil, python, wget, node, cscript, mshta to provide access to private hosting addresses and unlike the others. This is because the JavaScript enabled headless processes requests using the Microsoft Windows WebView2 handle.