MSHTA Launched by PowerShell with Explorer.exe Grandparent

Duo Tech@duotech

•updated Jul 20, 2026•1•0•7

Detects the execution of mshta.exe launched by powershell.exe where the command line includes a remote URL. This pattern mimics the 'ClickFix' execution chain where explorer.exe initiates PowerShell, which in turn invokes mshta.exe to fetch and execute a remote payload, a common technique for initial access and execution.