From 98e4b094ab3b800cf0e7eefd036085957db4e9b4 Mon Sep 17 00:00:00 2001 From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com> Date: Thu, 11 Feb 2021 14:35:06 -0700 Subject: [PATCH] HTML help spawning a child --- .../detect_html_help_spawn_child_process.yml | 46 +++++++++++++++++++ .../detect_html_help_url_in_command_line.yml | 3 +- ...ect_html_help_spawn_child_process.test.yml | 12 +++++ 3 files changed, 59 insertions(+), 2 deletions(-) create mode 100644 detections/endpoint/detect_html_help_spawn_child_process.yml create mode 100644 tests/endpoint/detect_html_help_spawn_child_process.test.yml diff --git a/detections/endpoint/detect_html_help_spawn_child_process.yml b/detections/endpoint/detect_html_help_spawn_child_process.yml new file mode 100644 index 0000000000..3cbeb23f6c --- /dev/null +++ b/detections/endpoint/detect_html_help_spawn_child_process.yml @@ -0,0 +1,46 @@ +name: Detect HTML Help Spawn Child Process +id: 723716de-ee55-4cd4-9759-c44e7e55ba4b +version: 1 +date: '2021-02-11' +description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) that spawns a child process. + This particular technique will load Windows script code from compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. + Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. + The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. + During investigation, identify script content origination. Review child process events and investigate further. + hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +type: ESCU +references: +- https://attack.mitre.org/techniques/T1218/001/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md +- https://lolbas-project.github.io/lolbas/Binaries/Hh/ +- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 +- https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ +author: Michael Haag, Splunk +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=hh.exe + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `detect_html_help_spawn_child_process_filter`' +known_false_positives: Although unlikely, some legitimate applications (ex. web browsers) may spawn a child process. Filter as needed. +tags: + analytic_story: + - Suspicious Compiled HTML file Activity + mitre_attack_id: + - T1218.001 + kill_chain_phases: + - Actions on Objectives + cis20: + - CIS 8 + nist: + - PR.PT + - DE.CM + security_domain: endpoint + asset_type: Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml index 59f3f140b5..f4f35708cc 100644 --- a/detections/endpoint/detect_html_help_url_in_command_line.yml +++ b/detections/endpoint/detect_html_help_url_in_command_line.yml @@ -6,8 +6,7 @@ description: The following analytic identifies hh.exe (HTML Help) execution of a This particular technique will load Windows script code from compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. - During investigation, identify script content origination. Generally, a child process will spawn from hh.exe, - but that may be bypassed based on script code contents. + During investigation, identify script content origination. Review reputation of remote IP and domain. Some instances, it is worth decompiling the .chm file to review its original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. diff --git a/tests/endpoint/detect_html_help_spawn_child_process.test.yml b/tests/endpoint/detect_html_help_spawn_child_process.test.yml new file mode 100644 index 0000000000..d35047875e --- /dev/null +++ b/tests/endpoint/detect_html_help_spawn_child_process.test.yml @@ -0,0 +1,12 @@ +name: Detect HTML Help Spawn Child Process Unit Test +tests: +- name: Detect HTML Help Spawn Child Process + file: endpoint/detect_html_help_spawn_child_process.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file