MSHTA Executing Remote Resource with .7z Extension
This rule detects instances where mshta.exe is used to execute a remote resource with a .7z file extension. This behavior is often indicative of an adversary attempting to bypass traditional security controls by disguising malicious script content as a compressed archive, as observed in some malware distribution campaigns.
Cortex XDR
