InstallFix - Silent COM Shell Launcher via HTA (T1559.001)
Identifies MSHTA executing embedded VBScript that suppresses its window while instantiating the Shell.Application COM object to launch subsequent scripts.
Microsoft Sentinel (KQL)

Identifies MSHTA executing embedded VBScript that suppresses its window while instantiating the Shell.Application COM object to launch subsequent scripts.

Already have an account?