Mshta.exe Remote Script Execution or Office Spawn - T1218.005
Detects the execution of mshta.exe when invoked with command-line arguments indicative of script execution (e.g., vbscript:, javascript:, http(s)://) or when spawned by common Microsoft Office applications. This behavior is frequently associated with malicious document-based attacks, where office macros trigger mshta to download or execute obfuscated code.
SentinelOne
