name: Detect HTML Help Using InfoTech Storage Handlers
id: 0b2eefa5-5508-450d-b970-3dd2fb761aec
version: 1
date: '2021-02-11'
author: Michael Haag, Splunk
type: batch
datamodel:
- Endpoint
description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
  HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique
  will load Windows script code from a compiled help file, using InfoTech Storage
  Handlers. itss.dll will load upon execution. Three InfoTech Storage handlers are
  supported - ms-its, its, mk:@MSITStore. ITSS may be used to launch a specific html/htm
  file from within a CHM file. CHM files may contain nearly any file type embedded.
  Upon a successful execution, the following script engines may be used for execution
  - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may
  identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm"
  and "html" file extensions were the only extensions observed to be supported for
  the execution of Shortcut commands or WSH script code. During investigation, identify
  script content origination. hh.exe is natively found in C:\Windows\system32 and
  C:\Windows\syswow64.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=hh.exe
  Processes.process IN ("*its:*", "*mk:@MSITStore:*") by Processes.dest Processes.user
  Processes.parent_process Processes.process_name Processes.process Processes.process_id
  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `detect_html_help_using_infotech_storage_handlers_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: It is rare to see instances of InfoTech Storage Handlers being
  used, but it does happen in some legitimate instances. Filter as needed.
references:
- https://attack.mitre.org/techniques/T1218/001/
- https://www.kb.cert.org/vuls/id/851869
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
- https://lolbas-project.github.io/lolbas/Binaries/Hh/
- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
- https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
tags:
  analytic_story:
  - Suspicious Compiled HTML Activity
  asset_type: Endpoint
  automated_detection_testing: passed
  cis20:
  - CIS 8
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1218.001
  nist:
  - PR.PT
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.process_name
  - Processes.process
  - Processes.dest
  - Processes.user
  - Processes.parent_process
  - Processes.process_id
  security_domain: endpoint
