Mshta Spawning Shell Process
Detects the execution of a shell process (like cmd.exe or powershell.exe) spawned by the Microsoft HTML Application Host (mshta.exe). This behavior is often associated with malicious HTA files that use scripting objects like "WScript.Shell" to execute arbitrary commands, as seen in campaigns distributing Epsilon Red ransomware.
Sigma
