Registry Run key persistence via mshta.exe remote HTA (zynaris.io)
Detects the creation of a Registry Run key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) with a specific value name ('MyApp') that invokes mshta.exe to execute a remote HTA file hosted at 'zynaris.io/ru1.hta'. This activity indicates an attempt to achieve persistence by leveraging a legitimate Windows binary (LOLBAS) to run potentially malicious scripts upon user logon, as observed in the SHADOW#REACTOR campaign.
Microsoft Sentinel (KQL)
