A security team discovers that attackers used 'mshta.exe' to execute malicious HTA (HTML Application) files hosted on an external server. Which application control measure most directly prevents this?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because mshta.exe is a Windows built-in that executes HTA files and has been heavily abused by attackers for LOLBin-based malware delivery; blocking it via application control (AppLocker/WDAC) prevents this technique in environments where HTA files have no legitimate business purpose. B is wrong because TLS inspection provides visibility into the download but does not prevent mshta.exe from executing HTA content if it reaches the endpoint.
Full explanation below image
Full Explanation
A is correct because mshta.exe is a Windows built-in that executes HTA files and has been heavily abused by attackers for LOLBin-based malware delivery; blocking it via application control (AppLocker/WDAC) prevents this technique in environments where HTA files have no legitimate business purpose. B is wrong because TLS inspection provides visibility into the download but does not prevent mshta.exe from executing HTA content if it reaches the endpoint. C is wrong because mshta.exe execution does not require administrative privileges; a standard user can execute HTA files. D is wrong because SmartScreen checks file reputation but can be bypassed; an application control block of mshta.exe is more reliable.