All Detections

Mshta Script Execution - LOTL Initial Access

avatar
Georg Lauenstein@gsec
updated Mar 7, 202620117

Detects mshta.exe executing remote or inline scripts, commonly abused for initial access in LOTL attacks

YARA-L