← All detection heuristics · HTML
critical
HTML_HTA_VBSCRIPT_DOM_EXECUTE
What it means
HTA/VBScript document executes code assembled from DOM text.
Why it fires
Malicious HTA attachments often split the real script across HTML text nodes, then use VBScript Execute to run the reconstructed body on load. This hides the payload from simple script-block scanners while preserving automatic execution.
Other HTML heuristics
HTML_THIRD_PARTY_CREDENTIAL_HARVEST HTML_ACTIVEX_OBJECT HTML_WINDOWS_SCRIPTING_OBJECT HTML_VBSCRIPT HTML_CREDENTIAL_PHISH_DYNDNS HTML_SCRIPTED_COM_EXECUTION HTML_SMUGGLED_PAYLOAD HTML_XOR_BASE64_EVAL_INJECTION HTML_LONG_BASE64_SCRIPT_PAYLOAD HTML_OBFUSCATED_STRING_BUILDER HTML_AD_FRAUD_CLOAKING HTML_BASE64_PAYLOAD_URL