Rule name: "Skopnix: mshta executing remote or inline script (T1218.005)"
Rule type: Event
Test stack:
  - and when the event(s) were detected by one or more of [Microsoft Windows Security Event Log, Microsoft Windows Sysmon]
  - and when the event matches this AQL filter query: "Process Name" ILIKE 'mshta.exe' AND ("Process CommandLine" ILIKE '%http://%' OR "Process CommandLine" ILIKE '%https://%' OR "Process CommandLine" ILIKE '%javascript:%' OR "Process CommandLine" ILIKE '%vbscript:%')
Response: dispatch new event / create offense indexed by Source IP; annotate "Skopnix T1218.005".
FP-safety: Local .hta files without a URL or inline script handler do not match.