detect_html_help_url_in_command_line.yml

name: Detect HTML Help URL in Command Line
id: 8c5835b9-39d9-438b-817c-95f14c69a31e
version: 2
date: '2021-09-16'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
  HTML Help (CHM) file from a remote url. This particular technique will load Windows
  script code from a compiled help file. CHM files may  contain nearly any file type
  embedded, but only execute html/htm. Upon a successful execution, the following
  script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode,
  JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe
  upon execution. The "htm" and "html" file extensions were the only extensions observed
  to be supported for the execution of Shortcut commands or WSH script code. During
  investigation, identify script content origination. Review reputation of remote
  IP and domain. Some instances, it is worth decompiling the .chm file to review its
  original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
data_source:
- Sysmon Event ID 1
search:
  selection1:
    OriginalFileName: HH.EXE
  selection2:
    Image|endswith: hh.exe
  selection3:
    CommandLine: '*http*'
  condition: (selection1 or selection2) and selection3
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
  endpoint product.
known_false_positives: Although unlikely, some legitimate applications may retrieve
  a CHM remotely, filter as needed.
references:
- https://attack.mitre.org/techniques/T1218/001/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
- https://lolbas-project.github.io/lolbas/Binaries/Hh/
- https://blog.sevagas.com/?Hacking-around-HTA-files
- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
- https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
tags:
  analytic_story:
  - Suspicious Compiled HTML Activity
  - Living Off The Land
  asset_type: Endpoint
  confidence: 100
  impact: 90
  message: An instance of $parent_proces_name$ spawning $process_name$ was identified
    on endpoint $dest$ by user $user$ contacting a remote destination to potentally
    download a malicious payload.
  mitre_attack_id:
  - T1218
  - T1218.001
  observable:
  - name: user
    type: User
    role:
    - Victim
  - name: dest
    type: Hostname
    role:
    - Victim
  - name: parent_process_name
    type: Process
    role:
    - Parent Process
  - name: process_name
    type: Process
    role:
    - Child Process
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 90
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog