Suspicious HWP Sub Process (gbb.exe)

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•14

Detects the creation of a 'gbb.exe' process as a sub-process of 'Hwp.exe' (Hangul Word Processor). This behavior is highly suspicious and often indicative of exploitation attempts targeting vulnerabilities within the HWP application, leading to the execution of malicious payloads.