HH.EXE Initiated HTTP Network Connection
Detects a network connection initiated by the "hh.exe" process to HTTP destination ports (80 or 443). This activity could indicate the execution or download of remotely hosted Compiled HTML (.chm) files, which can be abused by adversaries to conceal and execute malicious code. This technique is often used for defense evasion and can bypass application controls.
Sigma
