Microsoft HTML Help (hh.exe) Suspicious Child Process Execution

Microsoft HTML Help (hh.exe) is a legitimate Windows utility used to open Compiled HTML Help (.chm) files. Adversaries leverage this utility to execute arbitrary commands or scripts, effectively bypassing security controls that might otherwise block direct execution of malicious binaries or scripts. By crafting malicious CHM files that contain embedded script triggers, attackers can spawn suspicious child processes to conduct further stages of an attack.

Attack Chain

1. Delivery of a malicious .chm file to the target system via email or web download.
2. Execution of the .chm file, which automatically invokes 'hh.exe'.
3. Processing of the Compiled HTML Help content by 'hh.exe'.
4. Triggering of malicious embedded script (e.g., JScript or VBScript) within the .chm file context.
5. Spawning of a child process (e.g., cmd.exe, powershell.exe) by 'hh.exe' to execute secondary payloads or scripts.
6. Execution of further malicious operations by the spawned child process.

Recommendation

• Deploy the provided Sigma rule to detect suspicious child processes spawned by hh.exe.
• Baseline legitimate usage of .chm files in the environment to reduce false positives.
• Implement application control or execution policies that restrict or alert on the execution of common scripting engines (e.g., powershell.exe, cscript.exe) when spawned by hh.exe.