Detection: Windows System Binary Proxy Execution Compiled HTML File Decompile

Description

The following analytic identifies the decompile parameter with the HTML Help application, HH.exe. This is a uncommon command to see ran and behavior. Most recently this was seen in a APT41 campaign where a CHM file was delivered and a script inside used a technique for running an arbitrary command in a CHM file via an ActiveX object. This unpacks an HTML help file to a specified path for launching the next stage.

Annotations

No annotations available.

Implementation

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

Known False Positives

False positives should be limited, filter as needed.

Associated Analytic Story

• Suspicious Compiled HTML Activity

• Living Off The Land

Risk Based Analytics (RBA)

References

• https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/

• https://redcanary.com/blog/introducing-atomictestharnesses/

• https://attack.mitre.org/techniques/T1218/001/

• https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa

Version: 4