hh.exe Spawning wscript.exe/cscript.exe from CHM Lure (Kimsuky)

Ibrahim Saud@tektrix

•updated Jul 2, 2026•1•0•7

Detects the Windows Help executable (hh.exe) launching the Windows script interpreters (wscript.exe or cscript.exe) with suspicious command-line flags. This pattern is commonly used in fileless malware delivery, script-based obfuscation, and bypass of security controls using built-in Windows utilities.