Suspicious HH.exe Execution from Temporary or User Directories
Detects suspicious execution of Microsoft HTML Help (hh.exe) when it is launched from unusual or temporary directories, or with command-line arguments indicating potential malicious activity. Adversaries often abuse hh.exe to execute malicious code embedded within Compiled HTML (CHM) files, leveraging it as a living-off-the-land binary to bypass defenses and execute payloads. The rule specifically looks for hh.exe being executed from common temporary or user download paths, which are frequently used for initial access or staging.
Sigma
