Operation XENOFISCAL - Mshta Fetching Remote PHP and Executing

Ibrahim Saud@tektrix

•updated Jun 19, 2026•1•0•4

This rule detects the execution of mshta.exe with a command line that includes a remote fetch to 'abimj.edu.af/index.php'. It then correlates this activity with subsequent child process spawning, indicating potential malicious activity associated with the Operation XENOFISCAL campaign.