Remote CHM File Download/Execution Via HH.EXE (f57c58b3-ee69-4ef5-9041-455bf39aaa89)

Detects the usage of "hh.exe" to execute/download remotely hosted ".chm" files.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Compiled HTML File - T1218.001 (a6937325-9321-4e2e-bb2b-3ed2d40b2a9d)	Attack Pattern	Remote CHM File Download/Execution Via HH.EXE (f57c58b3-ee69-4ef5-9041-455bf39aaa89)	Sigma-Rules	1
Compiled HTML File - T1218.001 (a6937325-9321-4e2e-bb2b-3ed2d40b2a9d)	Attack Pattern	System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4)	Attack Pattern	2