Windows HH.exe Process Execution with Suspicious Command-Line Paths

title: Windows HH.exe Process Execution with Suspicious Command-Line Paths
id: 01098c90-7fc4-438f-aada-7dd7bc97f269
status: test
description: This rule flags process creation events where the image is Microsoft HTML Help (HH.exe) and the command line includes common user-writable and staging locations. Attackers often use HH.exe to execute payloads or proxy execution from temporary/download and Outlook-related directories, making this activity high-risk despite a legitimate file name. The detection relies on Windows process creation telemetry including the executable name/path and the full command line.
references:
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7
  - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
  - https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hh_susp_execution.yml
author: Maxim Pavlunin, Huntrule Team
date: 2020-04-01
modified: 2023-04-12
tags:
  - attack.execution
  - attack.initial-access
  - attack.stealth
  - attack.t1047
  - attack.t1059.001
  - attack.t1059.003
  - attack.t1059.005
  - attack.t1059.007
  - attack.t1218
  - attack.t1218.001
  - attack.t1218.010
  - attack.t1218.011
  - attack.t1566
  - attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - OriginalFileName: HH.exe
    - Image|endswith: \hh.exe
  selection_paths:
    CommandLine|contains:
      - .application
      - \AppData\Local\Temp\
      - \Content.Outlook\
      - \Downloads\
      - \Users\Public\
      - \Windows\Temp\
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: e8a95b5e-c891-46e2-b33a-93937d3abc31
    type: derived