Windows Process Creation: Suspicious Children Spawned by HTML Help (hh.exe)

ATT&CK techniques

Initial Access → Defense Evasion

Recon
Resource Dev
Initial Access
- T1566Phishing
- T1566.001Spearphishing Attachment
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation events where a Microsoft HTML Help executable (hh.exe) spawns a child process with a suspicious image name (e.g., CertReq.exe, CertUtil.exe, cmd.exe, PowerShell, regsvr32.exe, rundll32.exe, wmic.exe, wscript.exe). Attackers may leverage hh.exe to launch scripting or system utilities to execute payloads or perform discovery and persistence actions. The detection relies on process creation telemetry that includes parent and child process image paths.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Windows: Alert on Suspicious HH.EXE Process Execution

Windows AppLocker Audit-Mode Events Indicate Files Would Have Been Blocked

Windows AppLocker Blocked Application, Script, MSI, or Packaged-App Execution

Windows process creation: CrackMapExec execution via characteristic command-line flags

Windows: Koadic Command Prompt Invocation with /q /c chcp

Windows Process Creation: Suspicious Child Programs Spawned by mshta, PowerShell, wscript, rundll32

Suspicious PowerShell Spawned by cscript in Script Chain

Suspicious Script Host Execution of Decoy-Named JavaScript Dropper (PS1Bot)

Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell

Windows Process Creation: Suspicious Children Spawned by HTML Help (hh.exe)

Pivot detection · T1059.001 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-suspicious-child-processes-spawned-by-hh-exe-via-common-lolbins-52cad028

title: "Windows Process Creation: Suspicious Children Spawned by HTML Help (hh.exe)"
id: 5fe4fead-26d8-4d0b-88b3-0048c21fffe1
status: test
description: This rule flags Windows process creation events where a Microsoft HTML Help executable (hh.exe) spawns a child process with a suspicious image name (e.g., CertReq.exe, CertUtil.exe, cmd.exe, PowerShell, regsvr32.exe, rundll32.exe, wmic.exe, wscript.exe). Attackers may leverage hh.exe to launch scripting or system utilities to execute payloads or perform discovery and persistence actions. The detection relies on process creation telemetry that includes parent and child process image paths.
references:
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7
  - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
  - https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hh_html_help_susp_child_process.yml
author: Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2020-04-01
modified: 2023-04-12
tags:
  - attack.execution
  - attack.initial-access
  - attack.stealth
  - attack.t1047
  - attack.t1059.001
  - attack.t1059.003
  - attack.t1059.005
  - attack.t1059.007
  - attack.t1218
  - attack.t1218.001
  - attack.t1218.010
  - attack.t1218.011
  - attack.t1566
  - attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \hh.exe
    Image|endswith:
      - \CertReq.exe
      - \CertUtil.exe
      - \cmd.exe
      - \cscript.exe
      - \installutil.exe
      - \MSbuild.exe
      - \MSHTA.EXE
      - \msiexec.exe
      - \powershell.exe
      - \pwsh.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \schtasks.exe
      - \wmic.exe
      - \wscript.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 52cad028-0ff0-4854-8f67-d25dfcbc78b4
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL