Mshtml.DLL RunHTMLApplication Suspicious Usage

SigmaHQ Detections@sigmaHQ

•updated Feb 23, 2024•0•0•0

Detects execution of commands that leverage the "mshtml.dll" RunHTMLApplication export to run arbitrary code via different protocol handlers (vbscript, javascript, file, http...)