Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI

splApache-2.0from splunk/security_content

This analytic detects suspicious use of 'mshta.exe' or 'rundll32.exe' invoking 'mshtml.dll' or the 'RunHTMLApplication' export without including a direct HTTP/HTTPS URL in the command line. This pattern could be associated with obfuscated script execution used by threat actors during initial access or payload staging. The absence of a visible URL may indicate attempts to evade static detections by embedding the URL via string concatenation, encoding (e.g., hex), or indirect script loaders like 'GetObject()'.