Compiled HTML files, with the .chm extension, are normal on Windows. They are part of the Microsoft HTML Help system. MITRE ATT&CK tracks their abuse as T1218.001, Compiled HTML File, a System Binary Proxy Execution sub-technique in the Stealth tactic. The platform is Windows.
How attackers use it
CHM files are compressed compilations of HTML documents, images and web related scripting such as VBA, JScript, Java and ActiveX. Their content is displayed with underlying Internet Explorer components, loaded by the HTML Help executable, hh.exe.
MITRE says a custom CHM containing embedded payloads could be delivered to a victim and then triggered by User Execution. Execution through hh.exe may also bypass application control on older or unpatched systems that do not account for it.
The risk is that a help file looks like a document. People expect to click it.
How to detect it
The detection strategy looks for hh.exe opening a .chm file, followed by suspicious child processes or script engine invocation, such as VBScript, JScript, mshta or PowerShell. Two other signals are loading a CHM from an untrusted location and spawning commands immediately after the file opens.
Hh.exe rarely starts other programs in normal use. Process creation logs (Sysmon event ID 1 or Security event 4688) showing hh.exe as a parent of a shell or script host are a high quality alert.
How to reduce the risk
- Block download, transfer and execution of uncommon file types known to be used in adversary campaigns, such as CHM files, at the mail and web gateway.
- Use application control to prevent execution of hh.exe if it is not required on a system or network.
Check your own environment
- Does your mail gateway allow .chm attachments?
- Do your users still open help files from the internet?
- Is hh.exe allowed to run on servers where nobody needs it?
This read-only PowerShell command shows the active AppLocker policy rule collections on a Windows host:
Get-AppLockerPolicy -Effective | Select-Object -ExpandProperty RuleCollections
Where to start
Check two places this week. At the mail gateway, find out whether .chm attachments are delivered, and if they are, ask who actually needs them. At the endpoint, find out which machines have run hh.exe in the last quarter. If the answer is a small group of support staff, you can block hh.exe everywhere else with application control and keep the alert for any shell or script engine that appears as its child.
Quick check
Which child processes of hh.exe should raise an alert?
Script engines and shells, for example VBScript or JScript hosts, mshta and PowerShell.
Sources
- MITRE ATT&CK, T1218.001: https://attack.mitre.org/techniques/T1218/001
