MSHTA.exe HTA File Execution
Detects the execution of mshta.exe, specifically when initiated by explorer.exe and processing an HTA file. This behavior is often associated with malicious activity, as mshta.exe can be abused to execute arbitrary code.
Microsoft Sentinel (KQL)
