Windows: Alert on Suspicious HH.EXE Process Execution

ATT&CK techniques

Initial Access → Defense Evasion

Recon
Resource Dev
Initial Access
- T1566Phishing
- T1566.001Spearphishing Attachment
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags executions of Microsoft HTML Help (HH.exe) when the process image is HH.exe and the command line contains multiple common user-accessible or staging locations. Attackers often leverage HH.exe to blend in with legitimate Windows binaries while loading attacker-controlled content from temporary, downloads, public, or Outlook-related directories. The detection relies on process creation telemetry including the original filename, the executed image path, and the full command line.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Windows Process Creation: Suspicious Children Spawned by HTML Help (hh.exe)

Windows AppLocker Audit-Mode Events Indicate Files Would Have Been Blocked

Windows AppLocker Blocked Application, Script, MSI, or Packaged-App Execution

Windows process creation: CrackMapExec execution via characteristic command-line flags

Windows: Koadic Command Prompt Invocation with /q /c chcp

Windows Process Creation: Suspicious Child Programs Spawned by mshta, PowerShell, wscript, rundll32

Suspicious PowerShell Spawned by cscript in Script Chain

Suspicious Script Host Execution of Decoy-Named JavaScript Dropper (PS1Bot)

Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell

Windows: Alert on Suspicious HH.EXE Process Execution

Pivot detection · T1059.001 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-hh-exe-process-execution-with-suspicious-command-line-paths-e8a95b5e

title: "Windows: Alert on Suspicious HH.EXE Process Execution"
id: 01098c90-7fc4-438f-aada-7dd7bc97f269
status: test
description: This rule flags executions of Microsoft HTML Help (HH.exe) when the process image is HH.exe and the command line contains multiple common user-accessible or staging locations. Attackers often leverage HH.exe to blend in with legitimate Windows binaries while loading attacker-controlled content from temporary, downloads, public, or Outlook-related directories. The detection relies on process creation telemetry including the original filename, the executed image path, and the full command line.
references:
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7
  - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
  - https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hh_susp_execution.yml
author: Maxim Pavlunin, Huntrule Team
date: 2020-04-01
modified: 2023-04-12
tags:
  - attack.execution
  - attack.initial-access
  - attack.stealth
  - attack.t1047
  - attack.t1059.001
  - attack.t1059.003
  - attack.t1059.005
  - attack.t1059.007
  - attack.t1218
  - attack.t1218.001
  - attack.t1218.010
  - attack.t1218.011
  - attack.t1566
  - attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - OriginalFileName: HH.exe
    - Image|endswith: \hh.exe
  selection_paths:
    CommandLine|contains:
      - .application
      - \AppData\Local\Temp\
      - \Content.Outlook\
      - \Downloads\
      - \Users\Public\
      - \Windows\Temp\
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: e8a95b5e-c891-46e2-b33a-93937d3abc31
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL