Hayabusa medium test sigma

HH.EXE Initiated HTTP Network Connection

Detects a network connection initiated by the "hh.exe" process to HTTP destination ports, which could indicate the execution/download of remotely hosted .chm files.

View Source

Detection Logic

{
  "network_connection": {
    "EventID": 5156,
    "Channel": "Security"
  },
  "selection": {
    "Application
| endswith": "\\hh.exe",
    "Direction": "%%14593",
    "DestPort": [
      80,
      443
    ]
  },
  "condition": "network_connection and selection"
}

False Positives

  • ⚠ False positive is expected from launching "hh.exe" for the first time on a machine in a while or simply from help files containing reference to external sources. Best correlate this with process creation and file events.

Field Validations

Loading…

Comments (0)

Loading comments...