Remote HTA Execution via Mshta and Command-Line Flags
Detects command lines containing 'mshta', an argument flag such as '-c' or '/c', and a remote HTTP/HTTPS URL. This pattern is often used by adversaries to proxy execution, such as using 'pcalua.exe -c' to pass a remote HTA payload to 'mshta.exe', as observed in the initial access phase of EtherRAT infections.
Sigma
