Execution via Compiled HTML File

The Microsoft HTML Help system uses compiled HTML files (.chm) as part of its normal operation. Adversaries may conceal malicious code within CHM files and deliver them to victims for execution. CHM content is loaded by the HTML Help executable program (hh.exe). This technique allows attackers to proxy the execution of malicious payloads via a signed binary, hh.exe, potentially bypassing security controls and gaining initial access to environments via social engineering. The original Elastic detection rule was created in February 2020 and last updated April 7, 2026. This poses a threat because hh.exe is a legitimate Microsoft signed binary, making it more difficult to detect malicious activity without specific monitoring of its child processes.

Attack Chain

1. The attacker crafts a malicious CHM file containing embedded code, such as JavaScript or shellcode.
2. The attacker delivers the malicious CHM file to the victim, often via phishing or social engineering.
3. The victim opens the CHM file, which is then processed by hh.exe.
4. The hh.exe process executes the embedded malicious code within the CHM file.
5. The malicious code spawns a child process, such as cmd.exe, powershell.exe, or mshta.exe, to execute further commands.
6. The spawned process executes commands to download and execute a secondary payload, such as malware.
7. The malware establishes persistence on the system, allowing the attacker to maintain access.
8. The attacker performs actions on the compromised system, such as data exfiltration or lateral movement.

Impact

Successful exploitation allows attackers to execute arbitrary code on the victim's machine, leading to potential data compromise, system infection, and further malicious activity. The use of a signed Microsoft binary (hh.exe) makes detection more difficult, potentially allowing the attacker to operate undetected for a longer period. The impact ranges from single-machine compromise to wider network breaches depending on the attacker's objectives and capabilities.

Recommendation

• Deploy the Sigma rule "Detect Compiled HTML File Spawning Scripting Interpreters" to your SIEM and tune for your environment to detect the execution of scripting interpreters by hh.exe.
• Monitor process creation events for hh.exe spawning child processes such as cmd.exe, powershell.exe, and mshta.exe to identify potential exploitation attempts.
• Enable Sysmon process-creation logging to activate the rules above and ensure comprehensive logging of process activity.
• Implement application control policies to restrict the execution of cmd.exe, powershell.exe, and mshta.exe by hh.exe to prevent exploitation.