HH.EXE Execution with CHM File
This rule detects the execution of the 'hh.exe' utility when it is used to open Compiled HTML Help (.chm) files. Adversaries may abuse 'hh.exe' to execute malicious code embedded within CHM files, often as a method of defense evasion or to bypass application controls. The rule specifically looks for 'hh.exe' as the process image and the '.chm' extension in the command line arguments.
Sigma
