MSHTA Spawning PowerShell with Obfuscated Download and Execution (UAC-0184)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•3•0•5

Detects mshta.exe spawning PowerShell with hidden execution, web download, archive extraction, and staged process launch behavior, indicative of the UAC-0184 threat actor.