Suspicious Mshta Execution via Winword

S@1@N .@kohtet

•updated Jul 7, 2025•1•1•20

Detects mshta.exe (or renamed instances) being spawned by winword.exe, a common technique used in phishing attacks.