HTML Help HH.EXE Suspicious Child Process — Detection Rule

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

Read the full analysis on IntelFusions