Detection of Malicious Compiled HTML Help (CHM) Execution

The Microsoft HTML Help executable (hh.exe) is a legitimate Windows binary used to display CHM files. Attackers frequently abuse this binary to facilitate arbitrary code execution by crafting malicious CHM files that trigger scripts upon being opened. This technique (T1218.001) allows adversaries to bypass security controls by leveraging a signed, trusted system executable. This activity has been associated with various threat actors and malware families, including AgentTesla and APT37, as a reliable delivery vector for initial access or secondary stage payloads. Defenders should monitor for instances where hh.exe spawns child processes, as this behavior is typically absent during standard help documentation viewing.

Attack Chain

1. An attacker crafts a malicious CHM file containing embedded malicious scripts (e.g., JScript or VBScript).
2. The malicious file is delivered to the target via email attachments, file downloads, or social engineering.
3. The user opens the CHM file, triggering the execution of the Microsoft HTML Help engine (hh.exe).
4. The embedded script within the CHM file executes, invoking system commands or additional scripts.
5. The hh.exe process spawns a child process (e.g., cmd.exe, powershell.exe, or wscript.exe) to perform the malicious action.
6. The spawned child process initiates further malicious activity, such as downloading secondary payloads or performing exfiltration.

Impact

Successful exploitation of this technique can result in unauthorized code execution on the target Windows system. Attackers leverage this to establish initial access, execute malware, or perform persistence operations. This technique has been documented in diverse campaigns, including those attributed to APT37, and is frequently used to facilitate the deployment of infostealers like AgentTesla.

Recommendation

• Deploy the Sigma rule below to detect suspicious hh.exe parent-child relationships and tune based on local environmental baselines.
• Ingest process creation telemetry (Sysmon Event ID 1 or Windows Security Event ID 4688) into your SIEM to monitor for this specific parent-child lineage.
• Investigate occurrences where hh.exe initiates command-line interpreters or other suspicious child processes.
• Educate users regarding the risks of opening unsolicited CHM files from untrusted sources.