Remote CHM File Download/Execution Via HH.EXE

Rule Info

Name

Remote CHM File Download/Execution Via HH.EXE

Author

Nasreddine Bencherchali (Nextron Systems)

Description

Detects the usage of "hh.exe" to execute/download remotely hosted ".chm" files.

Reference

https://www.splunk.com/en_us/blog/security/follina-for-protocol-handlers.html

Date

2022-09-29 00:00:00

Modified

2024-01-31 00:00:00

f57c58b3-ee69-4ef5-9041-455bf39aaa89

Rule History

Author

Title

Date

Commit

github-actions[bot]

Merge PR #5101 from @nasbench - Promote older rules status from `experimental` to `test`

2024-12-01

936734901

Nasreddine Bencherchali

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12

598d29f81

Nasreddine Bencherchali

Merge PR #4702 from @nasbench - Rule tuning and updates

2024-02-12

2acebc90f

Nasreddine Bencherchali

feat: update hh.exe related rules

2023-04-12

5f6614b27

Nasreddine Bencherchali

fix: multiple typos

2023-02-06

1f34cecad

Nasreddine Bencherchali

feat: additional updates and fixes

2023-02-04

0795ed646

Nasreddine Bencherchali

chore: add nextron authors tag

2023-02-01

7c38a5c49

frack113

order yaml

2022-10-28

1f8e37351

Florian Roth

Update proc_creation_win_hh_chm_http.yml

2022-10-06

8a0cf2e7e

Nasreddine Bencherchali

Update + Rename

2022-10-05

40dcb9a4c

Nasreddine Bencherchali

Create proc_creation_win_hh_chm_http.yml

2022-09-29

bfc1d6a5b