All Detections

mshta.exe Outbound Network Connection

avatar
Kaung Khant Ko@kaungkhantko
updated Mar 31, 2026150126

mshta.exe is actively abused by DeepLoad early in the attack chain to reach attacker staging infrastructure.

Microsoft Sentinel (KQL)