Mshta.exe HTA File Execution
This rule detects the execution of Microsoft HTML Applications (HTA) files via mshta.exe, specifically when initiated by explorer.exe and the command line contains a reference to an .hta file. This behavior is often abused by adversaries to execute malicious scripts or payloads.
Microsoft Sentinel (KQL)
