Product
medium
advisory
Abuse of Microsoft HTML Help via InfoTech Storage Handlers
1 rule 1 TTPAttackers abuse the Microsoft HTML Help utility (hh.exe) to execute arbitrary code or scripts by loading malicious Compiled HTML Help (CHM) files via InfoTech Storage Handlers.
HTML Help
living-off-the-land
defense-evasion
windows
1r
1t
medium
advisory
Network Connection via Compiled HTML File
2 rules 3 TTPsThis rule detects network connections initiated by hh.exe, the HTML Help executable, which may indicate the execution of malicious code embedded in compiled HTML files (.chm) to deliver malicious payloads, bypass security controls, and gain initial access via social engineering.
HTML Help
execution
defense-evasion
command-and-control
malicious-file
html-help
2r
3t