Suspicious MSHTA Child Process — Detection Rule

Detects a suspicious process spawning from an "mshta.exe" process, which could be indicative of a malicious HTA script execution

Read the full analysis on IntelFusions