[WINDOWS-SECURITY] OneNote executing MSHTA

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SECURITY] OneNote executing MSHTA"; program:*Sysmon*
| *Security*; event_id:1,4688; content:"mshta.exe"; nocase; content:"onenote.exe"; nocase; reference:url,mapp.any.run/tasks/1ffa650a-1719-4d03-898b-951e7b1b8103/; classtype:trojan-activity; sid:5013843; rev:1; metadata:deployment Endpoint,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2023_02_01, updated_at 2023_02_01, mitre_tactic_id TA0005, mitre_technique_id T1211;)