Operation XENOFISCAL - Mshta launching PowerShell
Correlates mshta.exe (post-HTA load) spawning PowerShell to execute secondary stages like the .vmxx shellcode, as observed in Operation XENOFISCAL.
Microsoft Sentinel (KQL)
Correlates mshta.exe (post-HTA load) spawning PowerShell to execute secondary stages like the .vmxx shellcode, as observed in Operation XENOFISCAL.
Already have an account?