Cross-source coverage

T1218.001 / ATT&CK

System Binary Proxy Execution: Compiled HTML File

19 rules across 4 sources.

From MITRE ATT&CK 19.2

Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. CHM content is displayed using underlying components of the Internet Explorer browser loaded by the HTML Help executable program (hh.exe).

A custom CHM file containing embedded payloads could be delivered to a victim then triggered by User Execution. CHM execution may also bypass application application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe.

Tactics
Stealth
Platforms
Windows
Telemetry
WinEventLog:Sysmon

How MITRE says to detect it DET0342

Detection of Suspicious Compiled HTML File Execution via hh.exe

Windows Analytic 0968

Execution of hh.exe to open a.chm file followed by suspicious child processes or script engine invocation (VBScript, JScript, mshta, powershell). Behavior includes loading a CHM file from untrusted locations, or immediately spawning commands indicative of payload execution.

  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Sysmon EventCode=7
  • WinEventLog:Sysmon EventCode=3, 22

SigmaHQ/sigma

6 rules
Detection Severity Format
HTML Help HH.EXE Suspicious Child Process High Sigma
OneNote.EXE Execution of Malicious Embedded Scripts High Sigma
Remote CHM File Download/Execution Via HH.EXE High Sigma
Suspicious HH.EXE Execution High Sigma
HH.EXE Initiated HTTP Network Connection Medium Sigma
HH.EXE Execution Low Sigma

elastic/protections-artifacts

5 rules
Detection Severity Format
Execution of a Downloaded Windows Script via Explorer Undefined Elastic TOML
File Execution via Microsoft HTML Help Undefined Elastic TOML
Suspicious Execution via Compiled HTML File Undefined Elastic TOML
Suspicious Microsoft HTML Help Descendant Undefined Elastic TOML
Suspicious Windows Script Downloaded from the Internet Undefined Elastic TOML

splunk/security_content

5 rules
Detection Severity Format
Detect HTML Help Renamed Undefined SPL
Detect HTML Help Spawn Child Process Undefined SPL
Detect HTML Help URL in Command Line Undefined SPL
Detect HTML Help Using InfoTech Storage Handlers Undefined SPL
Windows System Binary Proxy Execution Compiled HTML File Decompile Undefined SPL

elastic/detection-rules

3 rules
Detection Severity Format
Process Activity via Compiled HTML File Medium Elastic TOML
Suspicious MS Office Child Process Medium Elastic TOML
Network Connection via Compiled HTML File Low Elastic TOML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.