Shadowcaptcha Fake Captcha Initial Access
Detects the execution of LOLBins (msiexec.exe, mshta.exe) with command-line arguments to download or execute remote files, a technique used in the ShadowCaptcha campaign's initial access phase via fake CAPTCHA pages.
YARA-L
