hh.exe Execution (PowerShell)

id: '17974.30258'
title: hh.exe Execution
description: 'Adversaries may abuse Compiled HTML files (.chm) to conceal malicious
  code. CHM files are commonly distributed as part of the Microsoft HTML Help system.
  A custom CHM file containing embedded payloads could be delivered to a victim then
  triggered by User Execution. -- Threat Actor Association: APT-K-47/Mysterious Elephant,
  Gamaredon (aka. Armageddon, UAC-0010), Kimsuky -- LOLBAS Atomics T1218.001 Test
  #1 Atomics T1218.001 Test #2 Atomics T1218.001 Test #3 Atomics T1218.001 Test #4
  Atomics T1218.001 Test #5 Atomics T1218.001 Test #6 Atomics T1218.001 Test #7 Atomics
  T1218.001 Test #8'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") (TERM(hh) OR TERM(hh.exe))
  | where match(process_name, "(?i)hh\.exe") OR match(process, "(?i)hh\.exe") | table
  _time, host, user process, process_*, parent_* | bin span=1s | stats values(*) as
  * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:compiled html file
technique_id:
- T1218.001
data_category:
- PowerShell logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md#atomic-test-8---decompile-local-chm-file
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
- https://asec.ahnlab.com/en/51746/