attack.t1218.001 | Detection.FYI

HH.EXE Execution
Apr 12, 2023 · attack.defense_evasion attack.t1218.001 ·
Share on:
Detects the usage of "hh.exe" to execute ".chm" files.

Read More
HTML Help HH.EXE Suspicious Child Process
Apr 12, 2023 · attack.defense_evasion attack.execution attack.initial_access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·
Share on:
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

Read More
Remote CHM File Download/Execution Via HH.EXE
Apr 12, 2023 · attack.defense_evasion attack.t1218.001 ·
Share on:
Detects the usage of "hh.exe" to execute/download remotely hosted ".chm" files.

Read More
Suspicious HH.EXE Execution
Apr 12, 2023 · attack.defense_evasion attack.execution attack.initial_access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·
Share on:
Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

Read More
HH.EXE Network Connections
Feb 1, 2023 · attack.defense_evasion attack.t1218.001 ·
Share on:
Detects network connections made by the "hh.exe" process, which could indicate the execution/download of remotely hosted .chm files

Read More