Hayabusa medium test sigma

HH.EXE Initiated HTTP Network Connection

Detects a network connection initiated by the "hh.exe" process to HTTP destination ports, which could indicate the execution/download of remotely hosted .chm files.

View Source

Detection Logic

{
  "network_connection": {
    "EventID": 3,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": {
    "Image
| endswith": "\\hh.exe",
    "Initiated": "true",
    "DestinationPort": [
      80,
      443
    ]
  },
  "condition": "network_connection and selection"
}

False Positives

⚠ False positive is expected from launching "hh.exe" for the first time on a machine in a while or simply from help files containing reference to external sources. Best correlate this with process creation and file events.

Field Validations

Loading…

Comments (0)

Loading comments...