Compiled HTML Access

Hypothesis and description

Adversaries may hide malicious code in .chm compiled HTML files. When these files are read, Windows uses the HTML help executable named hh.exe, which is the signature for this analytic.

Platforms: Windows
Domain: Host
Subtypes: Process
Submitted: 2020-11-30
Contributors: Olaf Hartong

ATT&CK coverage

Technique	Tactics	Coverage
T1218 System Binary Proxy ExecutionT1218.001	Stealth (formerly Defense Evasion)	High

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1218System Binary Proxy Execution
.001 Compiled HTML File

D3FEND techniques MITRE maps to this analytic

D3-PSA Process Spawn Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

process/create/exe

Pseudocode and implementations

PseudocodePseudocode - instances of hh.exeData model: CAR native

This is a pseudocode representation of the below splunk search.

processes = search Process:Create
target_processes = filter processes where (exe="C:\Windows\syswow64\hh.exe" OR exe="C:\Windows\system32\hh.exe")
output target_processes

SplunkSplunk Search - hh.exeData model: Sysmon native

looks all instances of hh.exe

(index=__your_sysmon_index__ EventCode=1) (Image="C:\\Windows\\syswow64\\hh.exe" OR Image="C:\\Windows\\system32\\hh.exe")

LogPointLogPoint Search - hh.exeData model: LogPoint native

looks all instances of hh.exe

norm_id=WindowsSysmon event_id=1 (image="C:\Windows\syswow64\hh.exe" OR image="C:\Windows\system32\hh.exe")

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

28 more in the full list

View CAR-2020-11-009 on car.mitre.org

TTPCAR-2020-11-009

Compiled HTML Access

Hypothesis and description

Adversaries may hide malicious code in .chm compiled HTML files. When these files are read, Windows uses the HTML help executable named hh.exe, which is the signature for this analytic.

Platforms: Windows
Domain: Host
Subtypes: Process
Submitted: 2020-11-30
Contributors: Olaf Hartong

ATT&CK coverage

Technique	Tactics	Coverage
T1218 System Binary Proxy ExecutionT1218.001	Stealth (formerly Defense Evasion)	High

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1218System Binary Proxy Execution
.001 Compiled HTML File

D3FEND techniques MITRE maps to this analytic

D3-PSA Process Spawn Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

process/create/exe

Pseudocode and implementations

PseudocodePseudocode - instances of hh.exeData model: CAR native

This is a pseudocode representation of the below splunk search.

processes = search Process:Create
target_processes = filter processes where (exe="C:\Windows\syswow64\hh.exe" OR exe="C:\Windows\system32\hh.exe")
output target_processes

SplunkSplunk Search - hh.exeData model: Sysmon native

looks all instances of hh.exe

(index=__your_sysmon_index__ EventCode=1) (Image="C:\\Windows\\syswow64\\hh.exe" OR Image="C:\\Windows\\system32\\hh.exe")

LogPointLogPoint Search - hh.exeData model: LogPoint native

looks all instances of hh.exe

norm_id=WindowsSysmon event_id=1 (image="C:\Windows\syswow64\hh.exe" OR image="C:\Windows\system32\hh.exe")

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

28 more in the full list

View CAR-2020-11-009 on car.mitre.org