APT41G0096 ↗
Used compiled HTML (.chm) files for targeting.1
tfMITRE ATT&CK sub-technique
Compiled HTML File T1218.001
sub-technique of T1218 System Binary Proxy Execution
- Tactic
- Stealth
- Platform
- Windows
- Version
- 3.0
- Created
- 23 January 2020
- Last modified
- 12 May 2026
- Contributor
- Rahmat Nurfauzi, @infosecn1nja, PT Xynexis International
Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. [1] CHM content is displayed using underlying components of the Internet Explorer browser [2] loaded by the HTML Help executable program (hh.exe). [3]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
5
Threat groups73rd pct
Threat groups73rd percentile · 73% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.11
Detection rulesTop 23%
Detection rules77th percentile · 77% of ATT&CK techniques have this many detection rules written or fewer.Compiled HTML File MITRE reference T1218.001
73rd pctamong all ATT&CK techniques for number of groups
5 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
SilenceG0091 ↗
APT38G0082 ↗
Has used CHM files to move concealed payloads.1
Dark CaracalG0070 ↗
Leveraged a compiled HTML file that contained a command to download and run an executable.1
OilRigG0049 ↗
Has used a CHM payload to load and execute another malicious file once delivered to a victim.1
All 5 groups for this technique
Offense vs defense T1218.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 5
first rule: 2019 Q4Compiled HTML File detection strategy DET0342
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Suspicious Compiled HTML File Execution via hh.exe
1 platform
AN0968 · Windows
Execution of hh.exe to open a .chm file followed by suspicious child processes or script engine invocation (VBScript, JScript, mshta, powershell). Behavior includes loading a CHM file from untrusted locations, or immediately spawning commands indicative of payload execution.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CHMPathRegex | Regex matching CHM file locations; tune to exclude trusted internal software help files |
| ChildProcessList | List of suspicious children of hh.exe (powershell.exe, cmd.exe, mshta.exe, wscript.exe) |
| NetworkDestinationAllowlist | Filter for legitimate update/help servers accessed by hh.exe |
| TimeWindow | Threshold time between hh.exe execution and suspicious follow-on activity |
1 analytic
Adversaries may hide malicious code in .chm compiled HTML files. When these files are read, Windows uses the HTML help executable named hh.exe, which is the signature for this analytic.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PSA | Process Spawn Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | exe |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
This is a pseudocode representation of the below splunk search.
processes = search Process:Create target_processes = filter processes where (exe="C:\Windows\syswow64\hh.exe" OR exe="C:\Windows\system32\hh.exe") output target_processes
looks all instances of hh.exe
(index=__your_sysmon_index__ EventCode=1) (Image="C:\\Windows\\syswow64\\hh.exe" OR Image="C:\\Windows\\system32\\hh.exe")
looks all instances of hh.exe
norm_id=WindowsSysmon event_id=1 (image="C:\Windows\syswow64\hh.exe" OR image="C:\Windows\system32\hh.exe")
Execution PreventionM1038
Consider using application control to prevent execution of hh.exe if it is not required for a given system or network to prevent potential misuse by adversaries.
Consider blocking download/transfer and execution of potentially uncommon file types known to be used in adversary campaigns, such as CHM files
Tests8ExecutorsPowerShell 5 · cmd 3Need elevation0 of 8Have prerequisites7Have cleanup1Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition