HH.EXE Execution of CHM Files

Luís Marques@remotecodeexecution

•updated today•0•0•0

This rule detects the execution of 'hh.exe' (Microsoft HTML Help Executable) specifically when it is used to open '.chm' (Compiled HTML Help) files. Adversaries often abuse 'hh.exe' to execute malicious code embedded within CHM files as a defense evasion technique, leveraging a legitimate system binary to proxy execution.