Invoke-Obfuscation via MSHTA and VBScript

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•21

Detects obfuscated PowerShell execution via mshta.exe, specifically looking for patterns indicative of VBScript execution within mshta that creates an object and runs a command, often used for defense evasion.