Malicious CHM Execution via hh.exe Spawning Scripting Engines

Ibrahim Saud@tektrix

•updated Jul 2, 2026•1•0•6

Detects suspicious execution patterns involving the Microsoft HTML Help executable (hh.exe). This includes the execution of Compiled HTML (.chm) files, or cases where hh.exe is used as a parent process to spawn common scripting or command-line interpreters such as wscript.exe, cscript.exe, powershell.exe, or cmd.exe. These behaviors are common indicators of malicious script execution or proxy execution techniques used to bypass security controls.