CHM file execution via hh.exe spawning wscript.exe

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•4

Detects the hh.exe (HTML Help) process spawning wscript.exe. This behavior is a common indicator of a Compiled HTML (CHM) file executing an embedded malicious VBScript payload, often used for initial access or malware delivery.