mshta.exe Remote HTA Script Execution via HTTP/HTTPS URL
Detects the execution of mshta.exe with a remote HTTP or HTTPS URL in the command line. This technique is commonly used by adversaries to execute malicious HTA files or scripts directly from a web server, bypassing traditional application whitelisting and browser-based security controls by leveraging a trusted, signed Windows utility.
SentinelOne
