MSHTA Execution with Suspicious File Extensions (via process_creation)

This rule detects execution of mshta.exe with file types that looks like they do not usually represent HTA (HTML Application) content, such as .png, .jpg, .zip, .pdf, and others, which are frequently polyglots. MSHTA is a legitimate Windows utility for running HTML Applications containing VBScript or JScript. Threat actors frequently misuse this lolbin utility to download and execute hostile scripts disguised as benign files or hosted under misleading extensions to evade detection.