LOLBAS - Execution - MSHTA Executing Command and Scripting Interpreters
This is a general rule meant to capture malicious MSHTA abuse pattern agnostic of the attack style or name (i.e., ClickFix, FakeCaptcha, FakeUpdates, ClearFake, etc.)
SentinelOne
