Windows: Suspicious subprocess execution from Hwp.exe spawning gbb.exe

ATT&CK techniques

Initial Access → Execution

Recon
Resource Dev
Initial Access
- T1566.001Spearphishing Attachment
Execution
- T1059.003Windows Command Shell
- T1203Exploitation for Client Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process creation events where a parent process ending in \Hwp.exe spawns a child process ending in \gbb.exe. Such spawned subprocesses from a Hangul Word Processor process can indicate exploitation or follow-on execution behavior. It relies on Windows process creation telemetry that captures ParentImage and Image paths.

Reporting behind it

Related detections9 linkedT1566.001 — drag to rearrange

Malicious Script Execution from WinRAR Extraction Directory via CVE-2023-38831

Malicious Microsoft Word Spawning Anomalous Child Process via CVE-2023-36884 (via process_creation)

Malicious Equation Editor Child Process Execution via process_creation

Windows Process Creation: Suspicious Children Spawned by HTML Help (hh.exe)

Windows: Alert on Suspicious HH.EXE Process Execution

Windows process creation: Winword launching FLTLDR.exe exploitation behavior

Windows Process Creation: EQNEDT32.EXE Used as CVE-2017-11882 Exploit Dropper Parent

Windows: Winword spawning csc.exe indicative of CVE-2017-8759 exploitation

Malicious Shell Spawned by SharePoint Worker Process w3wp

Windows: Suspicious subprocess execution from Hwp.exe spawning gbb.exe

Pivot detection · T1566.001 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-hwp-exe-spawned-gbb-exe-subprocess-detection-023394c4

title: "Windows: Suspicious subprocess execution from Hwp.exe spawning gbb.exe"
id: ad5f1b57-3623-4176-a397-6c4931b8e06a
status: test
description: This rule identifies process creation events where a parent process ending in \Hwp.exe spawns a child process ending in \gbb.exe. Such spawned subprocesses from a Hangul Word Processor process can indicate exploitation or follow-on execution behavior. It relies on Windows process creation telemetry that captures ParentImage and Image paths.
references:
  - https://www.securitynewspaper.com/2016/11/23/technical-teardown-exploit-malware-hwp-files/
  - https://www.hybrid-analysis.com/search?query=context:74940dcc5b38f9f9b1a0fea760d344735d7d91b610e6d5bd34533dd0153402c5&from_sample=5db135000388385a7644131f&block_redirect=1
  - https://twitter.com/cyberwar_15/status/1187287262054076416
  - https://blog.alyac.co.kr/1901
  - https://en.wikipedia.org/wiki/Hangul_(word_processor)
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hwp_exploits.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-10-24
modified: 2021-11-27
tags:
  - attack.initial-access
  - attack.t1566.001
  - attack.execution
  - attack.t1203
  - attack.t1059.003
  - attack.g0032
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \Hwp.exe
    Image|endswith: \gbb.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 023394c4-29d5-46ab-92b8-6a534c6f447b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL