Remotely Hosted HTA File Executed Via Mshta.EXE
This rule detects the execution of 'mshta.exe' with command-line arguments containing URL schemes like 'http://', 'https://', or 'ftp://'. This behavior is indicative of an attacker attempting to execute a remotely hosted HTML Application (HTA) file, which can be used for malicious purposes such as code execution or bypassing security controls. Attackers often leverage mshta.exe as a living-off-the-land binary (LOLBIN) to execute scripts or download additional payloads from remote servers.
Sigma
