MSHTA/WScript spawns PowerShell with encoded/obfuscated command
Detects the execution of PowerShell via mshta.exe or wscript.exe, specifically when the command line includes encoded commands. This is a common pattern for attackers using living-off-the-land binaries to execute obfuscated malicious payloads, bypassing basic security controls.
Microsoft Sentinel (KQL)
