Ransomware Series: MSHTA Proxy Execution of Remote or Encoded HTA Payload

Ibrahim Saud@tektrix

•updated 14 days ago•1•0•1

Detects instances where mshta.exe is launched from a web browser or explorer.exe with suspicious command-line arguments, such as remote URLs, script protocols, or potentially obfuscated/base64-encoded strings, often indicative of 'ClickFix' social engineering attacks.