cscli scenarios install sigmahq/proc_creation_win_hh_susp_execution1type: trigger2name: sigmahq/proc_creation_win_hh_susp_execution3description: |4 Detects a suspicious execution of a Microsoft HTML Help (HH.exe)5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.OriginalFileName == 'HH.exe' || evt.Parsed.Image endsWith '\\hh.exe') && (evt.Parsed.CommandLine contains '.application' || evt.Parsed.CommandLine contains '\\AppData\\Local\\Temp\\' || evt.Parsed.CommandLine contains '\\Content.Outlook\\' || evt.Parsed.CommandLine contains '\\Downloads\\' || evt.Parsed.CommandLine contains '\\Users\\Public\\' || evt.Parsed.CommandLine contains '\\Windows\\Temp\\'))7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t104715 - attack.t1059.00116 - attack.t1059.00317 - attack.t1059.00518 - attack.t1059.00719 - attack.t121820 - attack.t1218.00121 - attack.t1218.01022 - attack.t1218.01123 - attack.t156624 - attack.t1566.0012526 label: "Suspicious HH.EXE Execution"27 behavior : "windows:audit"28 remediation: false2930scope:31 type: ParentProcessId32 expression: evt.Parsed.ParentProcessId3334