Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
64 detections
Filters
Last updated
All Time
Detection languages
23
15
12
6
5
Contributors
15
13
8
5
5
Categories
31
23
17
8
6
Platforms
59
5
5
5
Products / Services
26
23
16
12
6
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
4
1
IDS Protocols
5
This rule detects the use of "hh.exe" to download or execute remotely hosted Compiled HTML Help (.chm) files. Adversaries may abuse hh.exe, a legitimate Windows utility, to bypass application control or execute malicious code by loading CHM files from remote HTTP/HTTPS or UNC paths. This technique can be used for defense evasion and initial access.
Page 4 of 4