Mshta.exe Launched with Remote URL Fetching .dat Payload
Detects the execution of mshta.exe with a command line involving remote HTTP connections or suspicious file extensions (.dat), which are often used by adversaries to proxy the execution of malicious scripts or HTA files.
Microsoft Sentinel (KQL)
