HTA File Spawning Curl to Download and Execute Payload
Detects the execution of an HTA file (via mshta.exe) that spawns a command prompt to silently download and execute a remote payload using curl. This behavior is consistent with the Epsilon Red ransomware campaign that uses malicious HTA files with embedded JScript to run shell commands.
Microsoft Sentinel (KQL)
