Invoke-Obfuscation via MSHTA Service Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

Detects the creation of a new service where the ImagePath contains 'mshta' and 'vbscript:createobject', indicating potential obfuscated PowerShell execution via MSHTA. This technique is often used for defense evasion and execution.