Windows: Alert on Suspicious HH.EXE Process Execution
Alerts on HH.exe execution where the command line references temp, downloads, Outlook, or other writable directories.
- Product
- windows
- Category
- process_creation
- Author
- Maxim Pavlunin (SigmaHQ), DRL 1.1
- Published
- 2020-04-01
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Defense EvasionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags executions of Microsoft HTML Help (HH.exe) when the process image is HH.exe and the command line contains multiple common user-accessible or staging locations. Attackers often leverage HH.exe to blend in with legitimate Windows binaries while loading attacker-controlled content from temporary, downloads, public, or Outlook-related directories. The detection relies on process creation telemetry including the original filename, the executed image path, and the full command line.
Reporting behind it
- trustwave.comhttps://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/
- github.comhttps://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7
- ptsecurity.comhttps://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
- zscaler.comhttps://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hh_susp_execution.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Alert on Suspicious HH.EXE Process Execution"
id: 01098c90-7fc4-438f-aada-7dd7bc97f269
status: test
description: This rule flags executions of Microsoft HTML Help (HH.exe) when the process image is HH.exe and the command line contains multiple common user-accessible or staging locations. Attackers often leverage HH.exe to blend in with legitimate Windows binaries while loading attacker-controlled content from temporary, downloads, public, or Outlook-related directories. The detection relies on process creation telemetry including the original filename, the executed image path, and the full command line.
references:
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/
- https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
- https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hh_susp_execution.yml
author: Maxim Pavlunin, Huntrule Team
date: 2020-04-01
modified: 2023-04-12
tags:
- attack.execution
- attack.initial-access
- attack.stealth
- attack.t1047
- attack.t1059.001
- attack.t1059.003
- attack.t1059.005
- attack.t1059.007
- attack.t1218
- attack.t1218.001
- attack.t1218.010
- attack.t1218.011
- attack.t1566
- attack.t1566.001
logsource:
category: process_creation
product: windows
detection:
selection_img:
- OriginalFileName: HH.exe
- Image|endswith: \hh.exe
selection_paths:
CommandLine|contains:
- .application
- \AppData\Local\Temp\
- \Content.Outlook\
- \Downloads\
- \Users\Public\
- \Windows\Temp\
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: e8a95b5e-c891-46e2-b33a-93937d3abc31
type: derived