CHM File Execution via hh.exe (Kimsuky Review.chm Lure)
Detects the execution of the Windows HTML Help executable (hh.exe) to open a Compiled HTML Help (.chm) file. The rule specifically monitors for known indicators associated with Kimsuky, including the 'Review.chm' lure name and a specific file hash identified in threat intelligence reporting as part of a multi-stage attack involving decoy content.
Sigma
