Potential LethalHTA Technique Execution
Detects a potential LethalHTA technique where 'mshta.exe' is spawned by an 'svchost.exe' process. This parent-child relationship is unusual and can indicate the abuse of mshta.exe for code execution, often bypassing application controls.
Sigma
