https://github.com/seb1k/block-mshta-with-intune

Block outbound connections from mshta.exe using Microsoft Intune Firewall Rules
https://github.com/seb1k/block-mshta-with-intune

endpoint-security hardening intune lolbas microsoft-intune microsoft-security mitre-attack mshta secure-score windows-firewall windows-security

Last synced: 29 days ago
JSON representation

Block outbound connections from mshta.exe using Microsoft Intune Firewall Rules

• Host: GitHub
• URL: https://github.com/seb1k/block-mshta-with-intune
• Owner: seb1k
• Created: 2026-05-27T09:44:28.000Z (about 2 months ago)
• Default Branch: main
• Last Pushed: 2026-05-27T13:49:16.000Z (about 2 months ago)
• Last Synced: 2026-05-27T15:26:20.116Z (about 2 months ago)
• Topics: endpoint-security, hardening, intune, lolbas, microsoft-intune, microsoft-security, mitre-attack, mshta, secure-score, windows-firewall, windows-security
• Homepage:
• Size: 11.7 KB
• Stars: 0
• Watchers: 0
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

          
# Block outbound connections for mshta.exe using Intune Firewall Rules

![Windows](https://img.shields.io/badge/Windows-10%20%7C%2011-0078D6?logo=windows)

![Intune](https://img.shields.io/badge/Microsoft-Intune-0078D4?logo=microsoft)

![Security](https://img.shields.io/badge/Security-Hardening-red)

[![MITRE](https://img.shields.io/badge/MITRE-T1218.005-red)](https://attack.mitre.org/techniques/T1218/005/)

[![LOLBAS](https://img.shields.io/badge/LOLBAS-mshta.exe-orange)](https://lolbas-project.github.io/lolbas/Binaries/Mshta/)

---

This configuration validates the Microsoft Secure Score recommendation:

> **Block outbound network connections from Microsoft HTML Application Host (`mshta.exe`)**

## Why block mshta.exe?

`mshta.exe` is frequently abused by attackers to execute malicious HTA payloads and establish outbound connections.

Blocking outbound traffic helps reduce the attack surface and improves Microsoft Secure Score compliance.

## Go to Intune > Endpoint security \| Firewall

https://intune.microsoft.com/?ref=AdminCenter#view/Microsoft_Intune_Workflows/SecurityManagementMenu/~/firewall

- **Create Policy**



- Platform : **Windows**

- Profile : **Windows Firewall Rules**



#### Basics

- Name : Block mshta.exe

- Description : Block outbound network connections from Microsoft HTML Application Host (mshta.exe)

#### Configuration Settings

- Add 2 firewall rules:

  - **Block C:\Windows\SysWOW64\mshta.exe**

  - **Block C:\Windows\System32\mshta.exe**

- Set the action to **Block** for both rules.



**Rule 1 Click Edit instance :**

- Enable : **Enabled**

- Interfaces types : **All**

- File Path: Click **Configure** → `C:\Windows\SysWOW64\mshta.exe`








**Rule 2 Click Edit instance :**

- Enable : **Enabled**

- Interfaces types : **All**

- File Path : Click **configuree** → `C:\Windows\System32\mshta.exe`








#### Scope Tags

Nothing

#### Assignments

- **All devices**



#### Review + create



## Validation

Test the policy with:

```powershell

Get-NetFirewallRule  -PolicyStore ActiveStore | Where-Object {$_.DisplayName -like "*mshta*"}