Suspicious MSHTA Execution With Fake Authentication URL
Detects the execution of mshta.exe containing a URL with an '@' character to spoof a legitimate domain (e.g., www.bbc.com@malicious.com). This technique is used by Gamaredon in the GammaPhish stage to obfuscate the real C2 domain when launching initial HTA payloads.
Sigma
