HTML Help spawns a script host or command interpreter

Siemphony@siemphonyhighT1218.001verified in labPlaybook · Unexpected execution

Matches process creation where hh.exe — the Microsoft HTML Help viewer that opens .chm files — is the parent of a script host or command interpreter, the shape AN0968 describes as "hh.exe followed by suspicious child processes or script engine invocation". hh.exe is invoked directly when a user opens a .chm file, so it is the process actually recorded on EID 1, not a wrapper that proxies to something else. The analytic's file-creation, module-load and network legs (Sysmon 11, 7, 3/22) describe a correlation across separate events and a TimeWindow Sigma cannot express, so only the single-event parent-child pair is authored. This is a distinct binary and a distinct parent-child shape from the rest of the T1218 family already in this corpus (cmstp.exe, regsvcs/regasm.exe, verclsid.exe, mavinject.exe, mmc.exe, Electron launcher switches), none of which key on hh.exe. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0342, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: HTML Help spawns a script host or command interpreter2id: 2c9b6d39-7aee-491a-b3a9-294810f92c1e3status: experimental4description: |5  Matches process creation where hh.exe — the Microsoft HTML Help viewer that6  opens .chm files — is the parent of a script host or command interpreter,7  the shape AN0968 describes as "hh.exe followed by suspicious child processes8  or script engine invocation". hh.exe is invoked directly when a user opens a9  .chm file, so it is the process actually recorded on EID 1, not a wrapper10  that proxies to something else. The analytic's file-creation, module-load11  and network legs (Sysmon 11, 7, 3/22) describe a correlation across separate12  events and a TimeWindow Sigma cannot express, so only the single-event13  parent-child pair is authored. This is a distinct binary and a distinct14  parent-child shape from the rest of the T1218 family already in this corpus15  (cmstp.exe, regsvcs/regasm.exe, verclsid.exe, mavinject.exe, mmc.exe,16  Electron launcher switches), none of which key on hh.exe.17  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0342, not hand-written and not tested by its author. Any lab result is on this rule's own page.18references:19  - https://attack.mitre.org/techniques/T1218/00120  - https://attack.mitre.org/detectionstrategies/DET034221author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)22date: 2026-08-1623tags:24  - attack.defense-evasion25  - attack.t1218.00126logsource:27  category: process_creation28  product: windows29detection:30  selection_parent:31    ParentImage|endswith: '\hh.exe'32  selection_child:33    Image|endswith:34      - '\powershell.exe'35      - '\pwsh.exe'36      - '\cmd.exe'37      - '\wscript.exe'38      - '\cscript.exe'39      - '\mshta.exe'40      - '\rundll32.exe'41  condition: selection_parent and selection_child42falsepositives:43  - "Vendor or internal help systems that use the CHM ShortCut/Exec macro feature to add a 'Run Diagnostic' or 'Open Command Prompt' button inside the help window, which spawns cmd.exe or rundll32.exe directly from hh.exe as designed CHM functionality."44  - "Helpdesk or troubleshooting-wizard CHM files that invoke cscript.exe or wscript.exe to collect system information when a user clicks a button inside the help viewer, a pattern some enterprise support tooling ships deliberately."45  - "Third-party software installers that bundle an interactive CHM wizard whose embedded macro calls powershell.exe or cmd.exe to perform a post-install configuration step from within the help viewer."46level: high

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (InitiatingProcessFolderPath endswith "\\hh.exe" and (FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\rundll32.exe"))

Splunk · SPL

Run this as a search.

index=* (ParentImage="*\\hh.exe" AND (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\cmd.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.parent.executable) LIKE "*\\\\hh.exe" AND (TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cmd.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rundll32.exe"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)\\hh\.exe$</field>    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$|\\cmd\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\rundll32\.exe$)</field>    <description>HTML Help spawns a script host or command interpreter</description>    <mitre>      <id>T1218.001</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: high
Category: signed_binary_proxy
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 2c9b6d39-7aee-491a-b3a9-294810f92c1e

ATT&CKT1218.001

T1218.001Compiled HTML File

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification2 runs

Verified in Siemphony lab

Security Datasets — hh.exe executing a local compiled-HTML payload
passed
Siemphony IR · 3 Sept 2026
1 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1218.001, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Populate CHMPathRegex — unused here — to exclude trusted internal help file paths, since this rule has no path check at all. The reviewer's evasion note is the sharper gap: the child list is an exact endswith match, so routing the ShortCut macro through a LOLBIN outside the list (forfiles.exe, msbuild.exe, installutil.exe, conhost.exe) or having hh.exe merely drop a file for later, unrelated execution defeats the parent-child pair entirely. NetworkDestinationAllowlist needs the unauthored Sysmon 3/22 leg.

Declared by the author

Vendor or internal help systems that use the CHM ShortCut/Exec macro feature to add a 'Run Diagnostic' or 'Open Command Prompt' button inside the help window, which spawns cmd.exe or rundll32.exe directly from hh.exe as designed CHM functionality.
Helpdesk or troubleshooting-wizard CHM files that invoke cscript.exe or wscript.exe to collect system information when a user clicks a button inside the help viewer, a pattern some enterprise support tooling ships deliberately.
Third-party software installers that bundle an interactive CHM wizard whose embedded macro calls powershell.exe or cmd.exe to perform a post-install configuration step from within the help viewer.

Lessonsigned binary proxy

signed binary proxyAI draft — unreviewed

01 · What this rule detects

hh.exe, the Microsoft HTML Help viewer, spawning a script host or command interpreter as its direct child. AN0968 describes "hh.exe followed by suspicious child processes or script engine invocation" — a user opens a .chm file, hh.exe launches to render it, and an embedded macro inside the CHM's ShortCut/Exec feature fires a second process. hh.exe is invoked directly by the shell association, so ParentImage on the resulting EID 1 event names hh.exe itself, not a proxy.

02 · Telemetry you need

Sysmon EventID 1 (process_creation), reading ParentImage and Image. No audit policy beyond standard Sysmon process-creation logging is required — this rule does not touch CommandLine, so it has no dependency on the separate command-line-logging policy that trips up 4688-based rules elsewhere in this corpus.

03 · How the logic works

Both fields must match on the same event — Sysmon records the parent-child relationship on the child's own creation record, so this is a single-event AND, not a correlation. ChildProcessList is MITRE's tuning knob for exactly this list; the seven binaries above are the author's populated values, not MITRE's. Only this parent-child pair is authored. AN0968 also names Sysmon 11 (file creation), Sysmon 7 (module load) and Sysmon 3/22 (network/DNS) as legs of the same analytic, and TimeWindow as the knob linking them — none of that is expressible as a single Sigma event, so none of it is covered here. A CHM that drops a payload to disk without spawning a child process, or one that phones home before executing anything, is invisible to this rule.

04 · Common false positives

All three false positives trace to the same legitimate CHM feature this rule keys on: the ShortCut/Exec macro that lets a help author put a working button inside the viewer. Vendor and internal help systems use it for "Run Diagnostic" or "Open Command Prompt" buttons that spawn cmd.exe or rundll32.exe directly from hh.exe as designed behavior. Helpdesk and troubleshooting-wizard CHMs invoke cscript.exe/wscript.exe to collect system info on a button click. Installer wizards packaged as CHM sometimes call powershell.exe/cmd.exe for a post-install step. None of this is attacker activity — it is the same mechanism MITRE describes, used as intended.
The reviewer also flagged that this rule's own child list includes rundll32.exe, which is the trigger process for the sibling T1218.011 rule already in this corpus. A genuine hh.exe → rundll32.exe → mshtml chain is expected to fire both rules together — that is corroboration, not double counting, but the rule's description understates it by naming its sibling T1218 rules without including T1218.011.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0342 and never executed against logs. level: high is the author's judgement; the reviewer found it consistent with the false positives as written, which are framed as narrow scenarios rather than dominant volume.
tier_2: means running it over history to confirm the ShortCut/Exec macro rate on your estate and widening the child list past the seven named binaries.
tier_3: means adding the Sysmon 11/7/3/22 legs and MITRE's TimeWindow.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/2c9b6d39-7aee-491a-b3a9-294810f92c1e

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

HTML Help spawns a script host or command interpreter

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it