Windows: Suspicious Child Processes Spawned by HH.exe via Common LOLBins

title: "Windows: Suspicious Child Processes Spawned by HH.exe via Common LOLBins"
id: 5fe4fead-26d8-4d0b-88b3-0048c21fffe1
status: test
description: This rule identifies Windows process creation events where Microsoft HTML Help (HH.exe) spawns a child process from a list of commonly abused execution utilities and scripting hosts. Such parent/child relationships can indicate document-based execution chains and attacker-controlled living-off-the-land activity. Telemetry relies on Windows process creation fields for the parent image (ending with \hh.exe) and the child image (ending with one of the specified binaries).
references:
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7
  - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
  - https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hh_html_help_susp_child_process.yml
author: Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2020-04-01
modified: 2023-04-12
tags:
  - attack.execution
  - attack.initial-access
  - attack.stealth
  - attack.t1047
  - attack.t1059.001
  - attack.t1059.003
  - attack.t1059.005
  - attack.t1059.007
  - attack.t1218
  - attack.t1218.001
  - attack.t1218.010
  - attack.t1218.011
  - attack.t1566
  - attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \hh.exe
    Image|endswith:
      - \CertReq.exe
      - \CertUtil.exe
      - \cmd.exe
      - \cscript.exe
      - \installutil.exe
      - \MSbuild.exe
      - \MSHTA.EXE
      - \msiexec.exe
      - \powershell.exe
      - \pwsh.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \schtasks.exe
      - \wmic.exe
      - \wscript.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 52cad028-0ff0-4854-8f67-d25dfcbc78b4
    type: derived