CHM file execution spawning hh.exe to wscript.exe script host chain
Detects the execution of wscript.exe as a child process of hh.exe (the Microsoft HTML Help executable). This behavior is often associated with the execution of malicious scripts embedded within CHM files, which is a common technique for bypassing security controls and executing arbitrary code.
Splunk (SPL)
