All Detections

Scheduled Task Executing Mshta

avatar
Brandon Rodriguez@BMRodriguez
updated May 22, 202640114

Detects the creation of scheduled tasks that explicitly call mshta.exe, matching the persistence mechanism of the CountLoader payload launcher.

Microsoft Sentinel (KQL)