Post #3122384

RE: https://infosec.exchange/@anyrun_app/116686468018998328 If you have the analytics available, demonstrate little-to-no use of mshta in your environment and then completely block this in your EDR/MDM. Then do this for finger.exe too. Deterministic, reliable, no overhead, and free; how I like my security. #clickfix