LOLBAS - Mshta - Suspicious Execution via mshta of Remote Files or for Ingress Tool transfer
Identifies execution of the mshta LOLBAS utility with command arguments containing the http/https or ftp keyword, which could indicate that an attacker is executing a remotely hosted malicious file for possible code execution AND/OR attempting to ingress a file. Seen in campaigns like lumma stealer.
Microsoft Sentinel (KQL)
