HTML help spawning a child

detections/endpoint/detect_html_help_spawn_child_process.yml

@@ -0,0 +1,46 @@
+name: Detect HTML Help Spawn Child Process
+id: 723716de-ee55-4cd4-9759-c44e7e55ba4b
+version: 1
+date: '2021-02-11'
+description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) that spawns a child process.
+  This particular technique will load Windows script code from compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm.
+  Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution.
+  The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code.
+  During investigation, identify script content origination. Review child process events and investigate further.
+  hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. 
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1218/001/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
+- https://lolbas-project.github.io/lolbas/Binaries/Hh/
+- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
+- https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=hh.exe
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `detect_html_help_spawn_child_process_filter`'
+known_false_positives: Although unlikely, some legitimate applications (ex. web browsers) may spawn a child process. Filter as needed.
+tags:
+  analytic_story:
+  - Suspicious Compiled HTML file Activity
+  mitre_attack_id:
+  - T1218.001
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log

detections/endpoint/detect_html_help_url_in_command_line.yml

@@ -6,8 +6,7 @@ description: The following analytic identifies hh.exe (HTML Help) execution of a
   This particular technique will load Windows script code from compiled help file. CHM files may  contain nearly any file type embedded, but only execute html/htm.
   Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution.
   The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code.
-  During investigation, identify script content origination. Generally, a child process will spawn from hh.exe,
-  but that may be bypassed based on script code contents. 
+  During investigation, identify script content origination.
   Review reputation of remote IP and domain.
   Some instances, it is worth decompiling the .chm file to review its original contents.
   hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. 

tests/endpoint/detect_html_help_spawn_child_process.test.yml

@@ -0,0 +1,12 @@
+name: Detect HTML Help Spawn Child Process Unit Test
+tests:
+- name: Detect HTML Help Spawn Child Process
+  file: endpoint/detect_html_help_spawn_child_process.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog