hh.exe spawns script host after opening Review.chm (Kimsuky CHM lure)

Ibrahim Saud@tektrix

•updated Jul 2, 2026•2•0•9

Detects the execution of Microsoft HTML Help (hh.exe) loading a .chm file, which subsequently spawns common command-line interpreters like cmd.exe, powershell.exe, or wscript.exe. This pattern is commonly used in phishing attacks to bypass security controls and execute malicious payloads.