MSHTA Executes Remote HTA from Remote URL with Numeric Path Segment
Detects the use of mshta.exe to execute code directly from a remote URL that includes a numeric path segment. This behavior is often associated with the retrieval of HTA, VBScript, or JScript payloads from attacker-controlled servers, where the numeric path may indicate a versioned payload or a specific exploit delivery mechanism.
Microsoft Sentinel (KQL)
