Gamaredon Spearphishing: mshta.exe Spawning wscript/cscript After Malicious Attachment Execution
Detects the execution of mshta.exe from common initial access vectors like document viewers (WinRAR), web browsers (Outlook, Thunderbird), or the Windows Shell (explorer.exe). Additionally, detects instances where mshta.exe subsequently spawns wscript.exe or cscript.exe, which is indicative of a multi-stage script execution chain often used to execute malicious payloads.
Splunk (SPL)
