Windows hh.exe Initiates HTTP(S) Network Connections

Flags hh.exe starting connections to ports 80/443, which may indicate access to remotely hosted content.

FreeUnreviewedSigmamediumv1

windows-hh-exe-initiates-http-s-network-connections-468a8cea

title: Windows hh.exe Initiates HTTP(S) Network Connections
id: 92dd7583-453a-4780-877c-9fd66be373f9
related:
  - id: f57c58b3-ee69-4ef5-9041-455bf39aaa89
    type: derived
  - id: 468a8cea-2920-4909-a593-0cbe1d96674a
    type: derived
status: test
description: This rule identifies HTTP(S) network connections initiated by the hh.exe process. Attackers can abuse hh.exe to reach remote content over ports 80 and 443, which may support execution or retrieval workflows involving externally hosted files. Telemetry relies on Windows network connection logs that include the process image name, connection initiation state, and destination port.
references:
  - https://www.splunk.com/en_us/blog/security/follina-for-protocol-handlers.html
  - https://github.com/redcanaryco/atomic-red-team/blob/1cf4dd51f83dcb0ebe6ade902d6157ad2dbc6ac8/atomics/T1218.001/T1218.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/network_connection/net_connection_win_hh_http_connection.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-05
tags:
  - attack.stealth
  - attack.t1218.001
  - detection.threat-hunting
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: \hh.exe
    Initiated: "true"
    DestinationPort:
      - 80
      - 443
  condition: selection
falsepositives:
  - False positive is expected from launching "hh.exe" for the first time on a machine in a while or simply from help files containing reference to external sources. Best correlate this with process creation and file events.
level: medium
license: DRL-1.1

What it detects

This rule identifies HTTP(S) network connections initiated by the hh.exe process. Attackers can abuse hh.exe to reach remote content over ports 80 and 443, which may support execution or retrieval workflows involving externally hosted files. Telemetry relies on Windows network connection logs that include the process image name, connection initiation state, and destination port.

Known false positives

False positive is expected from launching "hh.exe" for the first time on a machine in a while or simply from help files containing reference to external sources. Best correlate this with process creation and file events.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.