Windows Spearphishing Attachment OneNote Spawns Mshta

The analytic detects Microsoft OneNote spawning `mshta.exe`, a behavior often associated with spearphishing attacks. This activity is significant as it is commonly used by malware families like TA551, AsyncRat, Redline, and DCRAT to execute malicious scripts. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to data exfiltration, system compromise, or further malware deployment. Immediate investigation and containment are recommended.