drop 4688 or sysmon csv · remote hta · inline vbscript/javascript · child chains · mft hta status · export csv · runs locally
4688 / sysmon csv
drop evtx csv
or click
security 4688 · sysmon event 1 · optional mft csv for .hta presence
drop 4688 or sysmon evtx csv · optional mft csv for hta artifacts