{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/chm-exploitation/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Windows"],"_cs_severities":["medium"],"_cs_tags":["defense-evasion","living-off-the-land","windows-security","chm-exploitation"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eThe Microsoft HTML Help executable (hh.exe) is a legitimate Windows binary used to display CHM files. Attackers frequently abuse this binary to facilitate arbitrary code execution by crafting malicious CHM files that trigger scripts upon being opened. This technique (T1218.001) allows adversaries to bypass security controls by leveraging a signed, trusted system executable. This activity has been associated with various threat actors and malware families, including AgentTesla and APT37, as a reliable delivery vector for initial access or secondary stage payloads. Defenders should monitor for instances where hh.exe spawns child processes, as this behavior is typically absent during standard help documentation viewing.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious CHM file containing embedded malicious scripts (e.g., JScript or VBScript).\u003c/li\u003e\n\u003cli\u003eThe malicious file is delivered to the target via email attachments, file downloads, or social engineering.\u003c/li\u003e\n\u003cli\u003eThe user opens the CHM file, triggering the execution of the Microsoft HTML Help engine (hh.exe).\u003c/li\u003e\n\u003cli\u003eThe embedded script within the CHM file executes, invoking system commands or additional scripts.\u003c/li\u003e\n\u003cli\u003eThe hh.exe process spawns a child process (e.g., cmd.exe, powershell.exe, or wscript.exe) to perform the malicious action.\u003c/li\u003e\n\u003cli\u003eThe spawned child process initiates further malicious activity, such as downloading secondary payloads or performing exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this technique can result in unauthorized code execution on the target Windows system. Attackers leverage this to establish initial access, execute malware, or perform persistence operations. This technique has been documented in diverse campaigns, including those attributed to APT37, and is frequently used to facilitate the deployment of infostealers like AgentTesla.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule below to detect suspicious hh.exe parent-child relationships and tune based on local environmental baselines.\u003c/li\u003e\n\u003cli\u003eIngest process creation telemetry (Sysmon Event ID 1 or Windows Security Event ID 4688) into your SIEM to monitor for this specific parent-child lineage.\u003c/li\u003e\n\u003cli\u003eInvestigate occurrences where hh.exe initiates command-line interpreters or other suspicious child processes.\u003c/li\u003e\n\u003cli\u003eEducate users regarding the risks of opening unsolicited CHM files from untrusted sources.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T17:35:42Z","date_published":"2026-10-12T17:35:42Z","id":"https://feed.craftedsignal.io/briefs/2026-10-hh-exe-child-process/","summary":"Detection of the Microsoft HTML Help executable (hh.exe) spawning child processes, which indicates the potential use of malicious Compiled HTML Help (CHM) files to execute arbitrary scripts and bypass security controls.","title":"Detection of Malicious Compiled HTML Help (CHM) Execution","url":"https://feed.craftedsignal.io/briefs/2026-10-hh-exe-child-process/"}],"language":"en","title":"CraftedSignal Threat Feed - Chm-Exploitation","version":"https://jsonfeed.org/version/1.1"}