Payload Execution

On a Windows host where the operator already has command execution, a payload may be downloaded to a local path with CertUtil or curl, then executed as a compatible local script with Windows Script Host or launched as a remote HTA with mshta. The transfer is a separate optional action; Windows Script Host and mshta are different execution choices with different input types. These actions do not by themselves establish persistence or command and control.