Gamaredon HTML Smuggling HTA Delivery via mshta.exe Spawning wscript.exe
Detects instances where mshta.exe is used to launch suspicious child processes such as wscript.exe, cscript.exe, or powershell.exe, or is associated with HTA files or PteroSand-related indicators. This behavior is indicative of HTML smuggling or malicious HTA-based delivery of secondary payloads.
Splunk (SPL)
