Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
56 detections
Filters
Last updated
All Time
Detection languages
34
10
5
2
1
Contributors
17
12
10
9
2
Categories
45
15
8
3
3
Platforms
55
1
Products / Services
25
22
10
5
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
The following analytic detects the execution of hh.exe (HTML Help) spawning a child process, indicating the use of a Compiled HTML Help (CHM) file to execute Windows script code. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where hh.exe is the parent process. This activity is significant as it may indicate an attempt to execute malicious scripts via CHM files, a known technique for bypassing security controls. If confirmed malicious, this could lead to unauthorized code execution, potentially compromising the system.
The following analytic detects the execution of hh.exe (HTML Help) using InfoTech Storage Handlers to load Windows script code from a Compiled HTML Help (CHM) file. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant because it can be used to execute malicious scripts embedded within CHM files, potentially leading to code execution. If confirmed malicious, this technique could allow an attacker to execute arbitrary code, escalate privileges, or persist within the environment.
The following analytic detects the use of the decompile parameter with the HTML Help application (HH.exe). This behavior is identified through Endpoint Detection and Response (EDR) telemetry, focusing on command-line executions involving the decompile parameter. This activity is significant because it is an uncommon command and has been associated with APT41 campaigns, where it was used to unpack HTML help files for further malicious actions. If confirmed malicious, this technique could allow attackers to execute arbitrary commands, potentially leading to further compromise and persistence within the environment.
The following analytic detects the execution of hh.exe (HTML Help) loading a Compiled HTML Help (CHM) file from a remote URL. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions containing URLs. This activity is significant as it can indicate an attempt to execute malicious scripts via CHM files, potentially leading to unauthorized code execution. If confirmed malicious, this could allow an attacker to run scripts using engines like JScript or VBScript, leading to further system compromise or data exfiltration.
Detects the Microsoft HTML Help executable (hh.exe) spawning suspicious child processes such as command interpreters (cmd.exe, powershell.exe) or scripting engines (mshta.exe, wscript.exe). This behavior is characteristic of initial access techniques used by the Kimsuky (APT43) threat group, where malicious CHM files are delivered via email attachments to execute payloads.
Detects a suspicious execution chain where hh.exe (HTML Help) launches wscript.exe, which then executes certutil.exe, followed by the launch of powershell.exe. This pattern is commonly associated with Living-off-the-Land (LotL) techniques to execute malicious scripts or payloads, often used to bypass security controls or fetch remote files.
Detects the execution of Microsoft HTML Help (hh.exe) loading a .chm file, which subsequently spawns common command-line interpreters like cmd.exe, powershell.exe, or wscript.exe. This pattern is commonly used in phishing attacks to bypass security controls and execute malicious payloads.
Detects the execution of Microsoft HTML Help (hh.exe) with a .chm file in the command line. Adversaries often use Compiled HTML files (.chm) to conceal malicious code and bypass security controls, as they can execute scripts or launch other payloads when opened.
Detects suspicious execution patterns involving the Microsoft HTML Help executable (hh.exe). This includes the execution of Compiled HTML (.chm) files, or cases where hh.exe is used as a parent process to spawn common scripting or command-line interpreters such as wscript.exe, cscript.exe, powershell.exe, or cmd.exe. These behaviors are common indicators of malicious script execution or proxy execution techniques used to bypass security controls.
Detects the hh.exe (HTML Help) process spawning wscript.exe. This behavior is a common indicator of a Compiled HTML (CHM) file executing an embedded malicious VBScript payload, often used for initial access or malware delivery.
Detects the execution of the Windows HTML Help executable (hh.exe) to open a Compiled HTML Help (.chm) file. The rule specifically monitors for known indicators associated with Kimsuky, including the 'Review.chm' lure name and a specific file hash identified in threat intelligence reporting as part of a multi-stage attack involving decoy content.
Detects the execution of wscript.exe as a child process of hh.exe (the Microsoft HTML Help executable). This behavior is often associated with the execution of malicious scripts embedded within CHM files, which is a common technique for bypassing security controls and executing arbitrary code.
Detects instances where the Microsoft Compiled HTML Help executable (hh.exe) spawns wscript.exe. This behavior is a common indicator of a Compiled HTML Help (CHM) file being used to execute an embedded VBScript payload, often as part of an initial access or early stage infection chain.
This rule detects scenarios where the Microsoft HTML Help executable (hh.exe) is used to open a .chm (Compiled HTML) file, which then triggers the execution of wscript.exe. This behavior is a common technique used by attackers to execute malicious scripts hidden within CHM files, bypassing security controls by leveraging a legitimate system binary to initiate script execution.
Detects execution of compiled HTML help files containing malicious scripts
This rule detects outbound network connections to 'minemine.gleeze.com' on port 8443 originating from specific .NET utility processes (InstallUtil.exe, RegAsm.exe, MSBuild.exe). This activity is indicative of cryptojacking, specifically a campaign abusing ScreenConnect and .NET utilities for GPU mining, as described in the referenced Microsoft blog.
This rule detects the delivery of a Compiled HTML Help (CHM) file via HTTP that contains the string "ITSF" within its file data. CHM files can be used to deliver malicious content, and the presence of "ITSF" (likely indicating an InfoTech Storage Format header) combined with HTTP delivery suggests a potential attempt to bypass security controls or execute malicious code. This is often associated with T1218.001 (Signed Binary Proxy Execution: Compiled HTML Help) from the MITRE ATT&CK framework.
This YARA rule detects Compiled HTML Help (CHM) files based on specific internal strings related to their structure and compilation. The rule identifies CHM files that contain internal data space and compression references, as well as specific compiler signatures such as "Free Pascal's chm package 3.0.4", "CHMCmd 3.0.4", and "HHA Version 4.74.8702". While the rule's name suggests detection of JavaScript execution via PowerShell within CHM files, the current string-based logic primarily focuses on the file's internal characteristics and compiler metadata, which can be indicative of potentially malicious CHM files used in attack campaigns.
Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class.
This technique is often abused by attackers to download additional payloads.
This technique is often abused by attackers to download additional payloads.
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
Detects the usage of "hh.exe" to execute/download remotely hosted ".chm" files.
Page 1 of 3