MITRE ATT&CKsub-technique
T1218.001 Compiled HTML File
- Domain
- enterprise
- Tactics
- Stealth
- Platforms
- Windows
- Version
- 3.0
- Created
- 2020-01-23
Description
Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. CHM content is displayed using underlying components of the Internet Explorer browser loaded by the HTML Help executable program (hh.exe).
A custom CHM file containing embedded payloads could be delivered to a victim then triggered by User Execution. CHM execution may also bypass application application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe.
Related
Subtechnique of · MITRE ATT&CK (1)
- T1218 System Binary Proxy Execution technique
Tactic · MITRE ATT&CK (1)
- TA0005 Stealth tactic
Referenced by MITRE ATT&CK · mitigates (2)
Referenced by MITRE ATT&CK · uses (6)
Referenced by CAPEC · att&ck technique (1)
- CAPEC-636 Hiding Malicious Data or Code within Files attack pattern
Referenced by Compliance · mitigates (13)
- CIS-13.10 Perform Application Layer Filtering CIS Safeguard v8.1
- CIS-2.5 Allowlist Authorized Software CIS Safeguard v8.1
- CIS-9.6 Block Unnecessary File Types CIS Safeguard v8.1
- NIST-CM-11 User-installed Software NIST 800-53 control
- NIST-CM-2 Baseline Configuration NIST 800-53 control
- NIST-CM-6 Configuration Settings NIST 800-53 control
- NIST-CM-7 Least Functionality NIST 800-53 control
- NIST-SC-18 Mobile Code NIST 800-53 control
- NIST-SI-10 Information Input Validation NIST 800-53 control
- NIST-SI-16 Memory Protection NIST 800-53 control
- NIST-SI-3 Malicious Code Protection NIST 800-53 control
- NIST-SI-4 System Monitoring NIST 800-53 control
- NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control
References
- https://web.archive.org/web/20250419140549/https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2017-8625 Microsoft CVE-2017-8625 Aug 2017
- https://docs.microsoft.com/previous-versions/windows/desktop/htmlhelp/microsoft-html-help-1-4-sdk Microsoft HTML Help May 2018
- https://msdn.microsoft.com/windows/desktop/ms524405 Microsoft HTML Help Executable Program
- https://msdn.microsoft.com/windows/desktop/ms644670 Microsoft HTML Help ActiveX
- https://oddvar.moe/2017/08/13/bypassing-device-guard-umci-using-chm-cve-2017-8625/ MsitPros CHM Aug 2017