CHM lure spawns hh.exe launching wscript.exe (Kimsuky CHM tradecraft)
This rule detects scenarios where the Microsoft HTML Help executable (hh.exe) is used to open a .chm (Compiled HTML) file, which then triggers the execution of wscript.exe. This behavior is a common technique used by attackers to execute malicious scripts hidden within CHM files, bypassing security controls by leveraging a legitimate system binary to initiate script execution.
Microsoft Sentinel (KQL)
