Invoke-Obfuscation via MSHTA

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects obfuscated PowerShell execution leveraging MSHTA. The rule specifically looks for command-line arguments that indicate the use of 'set', '&&', 'mshta', 'vbscript:createobject', '.run', and '(window.close)', which are common patterns in MSHTA-based PowerShell obfuscation.