Skip to content
Threat Feed

Tag

Malicious-File

1 brief RSS
medium advisory

Network Connection via Compiled HTML File

This rule detects network connections initiated by hh.exe, the HTML Help executable, which may indicate the execution of malicious code embedded in compiled HTML files (.chm) to deliver malicious payloads, bypass security controls, and gain initial access via social engineering.

HTML Help execution defense-evasion command-and-control malicious-file html-help
2r 3t