WScript Spawned by hh.exe (CHM-Triggered VBScript Execution)
Detects instances where the Microsoft Compiled HTML Help executable (hh.exe) spawns wscript.exe. This behavior is a common indicator of a Compiled HTML Help (CHM) file being used to execute an embedded VBScript payload, often as part of an initial access or early stage infection chain.
Sigma
