{"id":51136071,"url":"https://github.com/seb1k/block-mshta-with-intune","last_synced_at":"2026-06-25T18:01:22.568Z","repository":{"id":360705014,"uuid":"1251153518","full_name":"seb1k/block-mshta-with-intune","owner":"seb1k","description":"Block outbound connections from mshta.exe using Microsoft Intune Firewall Rules","archived":false,"fork":false,"pushed_at":"2026-05-27T13:49:16.000Z","size":12,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-27T15:26:20.116Z","etag":null,"topics":["endpoint-security","hardening","intune","lolbas","microsoft-intune","microsoft-security","mitre-attack","mshta","secure-score","windows-firewall","windows-security"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/seb1k.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-05-27T09:44:28.000Z","updated_at":"2026-05-27T13:55:17.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/seb1k/block-mshta-with-intune","commit_stats":null,"previous_names":["seb1k/block-mshta-with-intune"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/seb1k/block-mshta-with-intune","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/seb1k%2Fblock-mshta-with-intune","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/seb1k%2Fblock-mshta-with-intune/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/seb1k%2Fblock-mshta-with-intune/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/seb1k%2Fblock-mshta-with-intune/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/seb1k","download_url":"https://codeload.github.com/seb1k/block-mshta-with-intune/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/seb1k%2Fblock-mshta-with-intune/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34786232,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-25T02:00:05.521Z","response_time":101,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["endpoint-security","hardening","intune","lolbas","microsoft-intune","microsoft-security","mitre-attack","mshta","secure-score","windows-firewall","windows-security"],"created_at":"2026-06-25T18:01:21.680Z","updated_at":"2026-06-25T18:01:22.544Z","avatar_url":"https://github.com/seb1k.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Block outbound connections for mshta.exe using Intune Firewall Rules\n\n![Windows](https://img.shields.io/badge/Windows-10%20%7C%2011-0078D6?logo=windows)\n![Intune](https://img.shields.io/badge/Microsoft-Intune-0078D4?logo=microsoft)\n![Security](https://img.shields.io/badge/Security-Hardening-red)\n[![MITRE](https://img.shields.io/badge/MITRE-T1218.005-red)](https://attack.mitre.org/techniques/T1218/005/)\n[![LOLBAS](https://img.shields.io/badge/LOLBAS-mshta.exe-orange)](https://lolbas-project.github.io/lolbas/Binaries/Mshta/)\n\n---\nThis configuration validates the Microsoft Secure Score recommendation:\n\n\u003e **Block outbound network connections from Microsoft HTML Application Host (`mshta.exe`)**\n\n## Why block mshta.exe?\n\n`mshta.exe` is frequently abused by attackers to execute malicious HTA payloads and establish outbound connections.\n\nBlocking outbound traffic helps reduce the attack surface and improves Microsoft Secure Score compliance.\n\n## Go to Intune \u003e Endpoint security \\| Firewall\n\nhttps://intune.microsoft.com/?ref=AdminCenter#view/Microsoft_Intune_Workflows/SecurityManagementMenu/~/firewall\n\n- **Create Policy**\n\u003cimg width=\"141\" height=\"101\" alt=\"image\" src=\"https://github.com/user-attachments/assets/0890f334-4852-42c1-8017-246e9d9654bc\" /\u003e\n\n- Platform : **Windows**\n- Profile : **Windows Firewall Rules**\n\n\u003cimg width=\"237\" height=\"466\" alt=\"image\" src=\"https://github.com/user-attachments/assets/40dbe3f9-827d-4b9e-a785-204e3779aaa8\" /\u003e\n\n#### Basics\n- Name : Block mshta.exe\n- Description : Block outbound network connections from Microsoft HTML Application Host (mshta.exe)\n\n#### Configuration Settings\n- Add 2 firewall rules:\n  - **Block C:\\Windows\\SysWOW64\\mshta.exe**\n  - **Block C:\\Windows\\System32\\mshta.exe**\n- Set the action to **Block** for both rules.\n\u003cimg width=\"987\" height=\"200\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6426149f-164d-4d74-b21f-3535bd6b15c8\" /\u003e\n\n\n**Rule 1 Click Edit instance :**\n- Enable : **Enabled**\n- Interfaces types : **All**\n- File Path: Click **Configure** → `C:\\Windows\\SysWOW64\\mshta.exe`\n\u003cimg width=\"897\" height=\"155\" alt=\"image\" src=\"https://github.com/user-attachments/assets/4c9f5186-365d-48b5-9c52-f0070b3e3fd1\" /\u003e\n\u003cbr/\u003e\n\u003cimg width=\"80\" height=\"32\" alt=\"image\" src=\"https://github.com/user-attachments/assets/36ccdacc-008a-4d3b-89e5-2722200fd479\" /\u003e\n\n\n**Rule 2 Click Edit instance :**\n- Enable : **Enabled**\n- Interfaces types : **All**\n- File Path : Click **configuree** → `C:\\Windows\\System32\\mshta.exe`\n\u003cimg width=\"906\" height=\"157\" alt=\"image\" src=\"https://github.com/user-attachments/assets/7311b907-8ed0-4a01-a0e1-d952d286cc0a\" /\u003e\n\u003cbr/\u003e\n\u003cimg width=\"80\" height=\"32\" alt=\"image\" src=\"https://github.com/user-attachments/assets/36ccdacc-008a-4d3b-89e5-2722200fd479\" /\u003e\n\n\n#### Scope Tags\nNothing\n#### Assignments\n- **All devices**\n\u003cimg width=\"304\" height=\"147\" alt=\"image\" src=\"https://github.com/user-attachments/assets/dc844e9c-23aa-4c33-bbdf-22017320966c\" /\u003e\n\n\n#### Review + create\n\u003cimg width=\"88\" height=\"37\" alt=\"image\" src=\"https://github.com/user-attachments/assets/e16819f6-d4e7-4958-b5c5-30de618b00eb\" /\u003e\n\n\n## Validation\n\nTest the policy with:\n\n```powershell\nGet-NetFirewallRule  -PolicyStore ActiveStore | Where-Object {$_.DisplayName -like \"*mshta*\"}\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fseb1k%2Fblock-mshta-with-intune","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fseb1k%2Fblock-mshta-with-intune","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fseb1k%2Fblock-mshta-with-intune/lists"}