T1218.001 System Binary Proxy Execution: Compiled HTML File

Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. MITRE ATT&CK

1 program on CmdID 5 Sigma rules T1218.001 on attack.mitre.org

Part of

MITRE ATT&CK

T1218System Binary Proxy Execution

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

highHTML Help HH.EXE Suspicious Child ProcessMaxim Pavlunin, Nasreddine Bencherchali (Nextron Systems) · Windows

highRemote CHM File Download/Execution Via HH.EXENasreddine Bencherchali (Nextron Systems) · Windows

highSuspicious HH.EXE ExecutionMaxim Pavlunin · Windows

lowHH.EXE ExecutionE.M. Anhaus (originally from Atomic Blue Detections, Dan Beavin), oscd.community · Windows