Sequential LOLBin chain: hh.exe > wscript.exe > certutil.exe > powershell.exe
Detects a suspicious execution chain where hh.exe (HTML Help) launches wscript.exe, which then executes certutil.exe, followed by the launch of powershell.exe. This pattern is commonly associated with Living-off-the-Land (LotL) techniques to execute malicious scripts or payloads, often used to bypass security controls or fetch remote files.
Microsoft Sentinel (KQL)
