WScript Launching MSHTA from Temp
Detects wscript.exe launching mshta.exe to execute files in the temporary directory. This behavior is indicative of Gamaredon's GammaDrop launching the GammaLoad HTA payload.
Microsoft Sentinel (KQL)
Detects wscript.exe launching mshta.exe to execute files in the temporary directory. This behavior is indicative of Gamaredon's GammaDrop launching the GammaLoad HTA payload.
Already have an account?