mshta.exe spawned by explorer.exe fetching remote script (LNK LotL)
Detects the execution of mshta.exe by explorer.exe with command line arguments containing script protocols (javascript:, vbscript:) or remote URLs. This is a common technique used by attackers to execute malicious HTA files or inline scripts, bypassing security controls.
Microsoft Sentinel (KQL)
