HTML Help HH.EXE Suspicious Child Process

Title: HTML Help HH.EXE Suspicious Child Process
Status: test
Description:Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
References:
  -https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/
  -https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7
  -https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
  -https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37
Author: Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)
Date: 2020-04-01
modified:2023-04-12
Tags:

• -'attack.execution'
• -'attack.initial-access'
• -'attack.stealth'
• -'attack.t1047'
• -'attack.t1059.001'
• -'attack.t1059.003'
• -'attack.t1059.005'
• -'attack.t1059.007'
• -'attack.t1218'
• -'attack.t1218.001'
• -'attack.t1218.010'
• -'attack.t1218.011'
• -'attack.t1566'
• -'attack.t1566.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    ParentImage|endswith: '\hh.exe'
    Image|endswith:
      -'\CertReq.exe'
      -'\CertUtil.exe'
      -'\cmd.exe'
      -'\cscript.exe'
      -'\installutil.exe'
      -'\MSbuild.exe'
      -'\MSHTA.EXE'
      -'\msiexec.exe'
      -'\powershell.exe'
      -'\pwsh.exe'
      -'\regsvr32.exe'
      -'\rundll32.exe'
      -'\schtasks.exe'
      -'\wmic.exe'
      -'\wscript.exe'

  condition:selection
Falsepositives:
  -Unknown
Level: high