Elastic Defend high stable eql

Suspicious Execution via Compiled HTML File

Identifies when the Microsoft HTML Help Executable (hh.exe) spawn a suspicious child process or open a compiled HTM file from a suspicious location. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution.

View Source

Detection Logic

process where event.action == "start" and
 (
  (process.parent.executable : "?:\\Windows\\hh.exe" and
   process.name : ("cmd.exe",
                  "powershell.exe",
                  "MSHTA.EXE",
                  "CertUtil.exe",
                  "CertReq.exe",
                  "rundll32.exe",
                  "regsvr32.exe",
                  "MSbuild.exe",
                  "cscript.exe",
                  "wscript.exe",
                  "installutil.exe",
                  "schtasks.exe",
                  "msiexec.exe")) or

  (process.parent.executable : "?:\\Windows\\hh.exe" and (process.code_signature.trusted == false or process.code_signature.exists == false))
  )

Field Validations

Loading…

Comments (0)

Loading comments...