Sub-technique of T1218 System Binary Proxy Execution.View on attack.mitre.org
Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. CHM content is displayed using underlying components of the Internet Explorer browser loaded by the HTML Help executable program (hh.exe).
A custom CHM file containing embedded payloads could be delivered to a victim then triggered by User Execution. CHM execution may also bypass application application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe.
Rules on DetectionCode tagged with T1218.001.
| Rule | Level | Log source |
|---|---|---|
| HTML Help HH.EXE Suspicious Child Process | high | windows / process_creation |
| OneNote.EXE Execution of Malicious Embedded Scripts | high | windows / process_creation |
| Remote CHM File Download/Execution Via HH.EXE | high | windows / process_creation |
| Suspicious HH.EXE Execution | high | windows / process_creation |
| HH.EXE Execution | low | windows / process_creation |
| Rule | Type | Risk | Data source |
|---|---|---|---|
| Detect HTML Help Renamed | Hunting | NULL | Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 |
| Detect HTML Help Spawn Child Process | TTP | NULL | Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 |
| Detect HTML Help URL in Command Line | TTP | NULL | Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data |
| Detect HTML Help Using InfoTech Storage Handlers | TTP | NULL | Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 |
| Windows System Binary Proxy Execution Compiled HTML File Decompile | TTP | NULL | Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 |
None recorded.
| Used by | Procedure example |
|---|---|
| GroupAPT38 | APT38 has used CHM files to move concealed payloads. |
| GroupAPT41 | APT41 used compiled HTML (.chm) files for targeting. |
| GroupDark Caracal | Dark Caracal leveraged a compiled HTML file that contained a command to download and run an executable. |
| GroupOilRig | OilRig has used a CHM payload to load and execute another malicious file once delivered to a victim. |
| GroupSilence | Silence has weaponized CHM files in their phishing campaigns. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
