Elastic Defend high stable eql

File Execution via Microsoft HTML Help

Identifies when the Microsoft HTML Help Executable (hh.exe) creates a portable executable (PE) file and the file is subsequently executed. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution.

View Source

Detection Logic

sequence with maxspan=2m
 [file where event.action != "deletion" and process.name : "hh.exe"] by file.path
 [process where event.action == "start"] by process.executable

Field Validations

Loading…

Comments (0)

Loading comments...