MITRE CAR unknown stable spl
Compiled HTML Access
Adversaries may hide malicious code in .chm compiled HTML files. When these files are read, Windows uses the HTML help executable named hh.exe, which is the signature for this analytic.
Detection Logic
(index=__your_sysmon_index__ EventCode=1) (Image="C:\\Windows\\syswow64\\hh.exe"
OR Image="C:\\Windows\\system32\\hh.exe")Field Validations
Loading…
Comments (0)
Loading comments...