Remote CHM File Download/Execution Via HH.EXE
This rule detects the use of "hh.exe" to download or execute remotely hosted Compiled HTML Help (.chm) files. Adversaries may abuse hh.exe, a legitimate Windows utility, to bypass application control or execute malicious code by loading CHM files from remote HTTP/HTTPS or UNC paths. This technique can be used for defense evasion and initial access.
Sigma
