Windows hh.exe Initiates HTTP(S) Network Connections
Flags hh.exe starting connections to ports 80/443, which may indicate access to remotely hosted content.
- Product
- windows
- Category
- network_connection
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-10-05
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags when hh.exe on Windows initiates a network connection to HTTP and HTTPS destination ports (80/443). Such activity can indicate that the HTML Help process is being used to reach externally hosted content, making it relevant for spotting stealthy retrieval behavior. It relies on network connection telemetry that records the initiating process and destination port.
Reporting behind it
- splunk.comhttps://www.splunk.com/en_us/blog/security/follina-for-protocol-handlers.html
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/1cf4dd51f83dcb0ebe6ade902d6157ad2dbc6ac8/atomics/T1218.001/T1218.001.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/network_connection/net_connection_win_hh_http_connection.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows hh.exe Initiates HTTP(S) Network Connections
id: 92dd7583-453a-4780-877c-9fd66be373f9
related:
- id: f57c58b3-ee69-4ef5-9041-455bf39aaa89
type: derived
- id: 468a8cea-2920-4909-a593-0cbe1d96674a
type: derived
status: test
description: This rule flags when hh.exe on Windows initiates a network connection to HTTP and HTTPS destination ports (80/443). Such activity can indicate that the HTML Help process is being used to reach externally hosted content, making it relevant for spotting stealthy retrieval behavior. It relies on network connection telemetry that records the initiating process and destination port.
references:
- https://www.splunk.com/en_us/blog/security/follina-for-protocol-handlers.html
- https://github.com/redcanaryco/atomic-red-team/blob/1cf4dd51f83dcb0ebe6ade902d6157ad2dbc6ac8/atomics/T1218.001/T1218.001.md
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/network_connection/net_connection_win_hh_http_connection.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-05
tags:
- attack.stealth
- attack.t1218.001
- detection.threat-hunting
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith: \hh.exe
Initiated: "true"
DestinationPort:
- 80
- 443
condition: selection
falsepositives:
- False positive is expected from launching "hh.exe" for the first time on a machine in a while or simply from help files containing reference to external sources. Best correlate this with process creation and file events.
level: medium
license: DRL-1.1