mshta running script code
mshta.exe is the Windows host for HTML applications. Here it was started three times to run script code: inline VBScript, inline JavaScript that loads a remote scriptlet, and a local HTA file. The log also contains every other process started on the same machines, and 2,215 process starts from a clean Windows 10 client. Write a rule that finds the three mshta starts.
Hint 1
Look at how each of the three command lines passes the script to mshta. Which part do they share?
Hint 2
Processes started by mshta are part of the same chain; matching them does not count as a false positive.
The rule runs in this browser; it is saved here so you can come back to it.
Events
2,230 events. Search filters the table; it does not affect the result.