MSHTA Launching Remote .hta file
Detects mshta.exe being launched from explorer.exe or cmd.exe with a command line argument pointing to a remote HTTP/HTTPS resource ending in .hta. This pattern is commonly used by adversaries to execute malicious remote HTML applications for initial access or code execution.
CQL
