name: Detect HTML Help URL in Command Line
id: 8c5835b9-39d9-438b-817c-95f14c69a31e
version: 1
date: '2021-02-11'
author: Michael Haag, Splunk
type: batch
datamodel:
- Endpoint
description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
  HTML Help (CHM) file from a remote url. This particular technique will load Windows
  script code from a compiled help file. CHM files may  contain nearly any file type
  embedded, but only execute html/htm. Upon a successful execution, the following
  script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode,
  JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe
  upon execution. The "htm" and "html" file extensions were the only extensions observed
  to be supported for the execution of Shortcut commands or WSH script code. During
  investigation, identify script content origination. Review reputation of remote
  IP and domain. Some instances, it is worth decompiling the .chm file to review its
  original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=hh.exe
  Processes.process=*http* by Processes.dest Processes.user Processes.parent_process
  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `detect_html_help_url_in_command_line_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: Although unlikely, some legitimate applications may retrieve
  a CHM remotely, filter as needed.
references:
- https://attack.mitre.org/techniques/T1218/001/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
- https://lolbas-project.github.io/lolbas/Binaries/Hh/
- https://blog.sevagas.com/?Hacking-around-HTA-files
- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
- https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
tags:
  analytic_story:
  - Suspicious Compiled HTML Activity
  asset_type: Endpoint
  automated_detection_testing: passed
  cis20:
  - CIS 8
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1218.001
  nist:
  - PR.PT
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.process_name
  - Processes.process
  - Processes.dest
  - Processes.user
  - Processes.parent_process
  - Processes.process_id
  - Processes.parent_process_id
  security_domain: endpoint
