cscli scenarios install sigmahq/proc_creation_win_hh_html_help_susp_child_process1type: trigger2name: sigmahq/proc_creation_win_hh_html_help_susp_child_process3description: |4 Detects a suspicious child process of a Microsoft HTML Help (HH.exe)5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.ParentImage endsWith '\\hh.exe' && (evt.Parsed.Image endsWith '\\CertReq.exe' || evt.Parsed.Image endsWith '\\CertUtil.exe' || evt.Parsed.Image endsWith '\\cmd.exe' || evt.Parsed.Image endsWith '\\cscript.exe' || evt.Parsed.Image endsWith '\\installutil.exe' || evt.Parsed.Image endsWith '\\MSbuild.exe' || evt.Parsed.Image endsWith '\\MSHTA.EXE' || evt.Parsed.Image endsWith '\\msiexec.exe' || evt.Parsed.Image endsWith '\\powershell.exe' || evt.Parsed.Image endsWith '\\pwsh.exe' || evt.Parsed.Image endsWith '\\regsvr32.exe' || evt.Parsed.Image endsWith '\\rundll32.exe' || evt.Parsed.Image endsWith '\\schtasks.exe' || evt.Parsed.Image endsWith '\\wmic.exe' || evt.Parsed.Image endsWith '\\wscript.exe'))7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t104715 - attack.t1059.00116 - attack.t1059.00317 - attack.t1059.00518 - attack.t1059.00719 - attack.t121820 - attack.t1218.00121 - attack.t1218.01022 - attack.t1218.01123 - attack.t156624 - attack.t1566.0012526 label: "HTML Help HH.EXE Suspicious Child Process"27 behavior : "windows:audit"28 remediation: false2930scope:31 type: ParentProcessId32 expression: evt.Parsed.ParentProcessId3334