value:  Metamorfo has used mshta.exe to execute a HTA payload. ;; MuddyWater has used mshta.exe to execute its POWERSTATS payload and to pass a PowerShell one-liner for execution. ;; Mustang Panda has used mshta.exe to launch collection scripts. ;; NanHaiShu uses mshta.exe to load its program and files. ;; POWERSTATS can use Mshta.exe to execute additional payloads on compromised hosts. ;; Revenge RAT uses mshta.exe to run malicious scripts on the system. ;; Sibot has been executed via MSHTA application. ;; Sidewinder has used mshta.exe to execute malicious payloads. ;; TA551 has used mshta.exe to execute malicious payloads. ;; Xbash can use mshta for executing scripts.
name: Signed Binary Proxy Execution: Mshta