Mshta Suspicious Child Process

selection:
  process.command_line: "*"
  process.parent.name: mshta.exe
  process.parent.command_line
| contains:
    - http
    - script
    - .hta
  process.name:
    - cmd.exe
    - powershell.exe
    - powershell_ise.exe
    - curl.exe
    - wget.exe
    - rundll32.exe
    - regsvr32.exe
    - cscript.exe
    - wscript.exe
    - bitsadmin.exe
filters:
  process.command_line
| contains:
    - .txt
    - .json
    - printui.dll
condition: selection and not filters