//proxy execution via mshta to .hta file
DeviceFileEvents
| where DeviceName startswith "ryn"
| where InitiatingProcessParentFileName == "mshta.exe"
     and FileName endswith ".hta"
     or PreviousFileName endswith ".hta"