HTML Help HH.EXE Suspicious Child Process

calendar Aug 12, 2024 · attack.defense-evasion attack.execution attack.initial-access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001  ·
Share on: linkedin copy

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

Sigma rule (View on GitHub)

 1title: HTML Help HH.EXE Suspicious Child Process
 2id: 52cad028-0ff0-4854-8f67-d25dfcbc78b4
 3status: test
 4description: Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
 5references:
 6    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/
 7    - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7
 8    - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
 9    - https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37
10author: Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)
11date: 2020-04-01
12modified: 2023-04-12
13tags:
14    - attack.defense-evasion
15    - attack.execution
16    - attack.initial-access
17    - attack.t1047
18    - attack.t1059.001
19    - attack.t1059.003
20    - attack.t1059.005
21    - attack.t1059.007
22    - attack.t1218
23    - attack.t1218.001
24    - attack.t1218.010
25    - attack.t1218.011
26    - attack.t1566
27    - attack.t1566.001
28logsource:
29    category: process_creation
30    product: windows
31detection:
32    selection:
33        ParentImage|endswith: '\hh.exe'
34        Image|endswith:
35            - '\CertReq.exe'
36            - '\CertUtil.exe'
37            - '\cmd.exe'
38            - '\cscript.exe'
39            - '\installutil.exe'
40            - '\MSbuild.exe'
41            - '\MSHTA.EXE'
42            - '\msiexec.exe'
43            - '\powershell.exe'
44            - '\pwsh.exe'
45            - '\regsvr32.exe'
46            - '\rundll32.exe'
47            - '\schtasks.exe'
48            - '\wmic.exe'
49            - '\wscript.exe'
50    condition: selection
51falsepositives:
52    - Unknown
53level: high

References

  • CHM Badness Delivers a Banking Trojan

    Like good old Microsoft Office Macros, Compiled HTML (CHM) Help files have been utilized by malware authors for more than a decade to sneak malicious downloader code into files making them harder to detect. CHMs are a Microsoft proprietary online...


    Read More

  • Updating artifacts · elastic/protections-artifacts@7460867

    Elastic Security detection content for Endpoint. Contribute to elastic/protections-artifacts development by creating an account on GitHub.


    Read More

  • Higaisa or Winnti? APT41 backdoors, old and new

    The PT Expert Security Center regularly spots emerging threats to information security, including both previously known and newly discovered malware. During such monitoring in May 2020, we detected several samples of new malware that at first glance would seem to belong to the Higaisa group. But detailed analysis pointed to the Winnti group (also known as APT41, per FireEye) of Chinese origin. Subsequent monitoring led us to discover a number of new malware samples used by the group in recent attacks. These include various droppers, loaders, and injectors; Crosswalk, ShadowPad, and PlugX backdoors; and samples of a previously undescribed backdoor that we have dubbed FunnySwitch. We can confidently state that some of these attacks were directed at a number of organizations in Russia and Hong Kong. In this article, we will share the results of our investigation of these samples and related network infrastructure, as well as overlaps with previously described attacks.


    Read More

  • The Unintentional Leak: A glimpse into the attack vectors of APT37

    An operational security failure by the North Korean threat actor - APT37, led to the discovery of many previously unknown tools and techniques used by them


    Read More

Related rules

to-top