MSHTA Remote VBScript COM Object Launching PowerShell In-Memory
Detects the use of mshta.exe to fetch and execute remote content that subsequently spawns PowerShell, often utilizing techniques to obfuscate commands or load scripts in-memory. This behavior is indicative of fileless malware execution or stage-two payload delivery.
Microsoft Sentinel (KQL)
