Suspicious Staging and Compilation Activity via HTML Help Workshop
Detects potential staging and execution activity where utilities such as expand, xcopy, or attrib referencing .rels.log files are followed by the launch of HTML Help Workshop (hhc.exe) from a temporary directory within a short time window, optionally correlated with ftp.exe command execution.
Microsoft Sentinel (KQL)
