Tag
medium
advisory
Process Activity via Compiled HTML File Execution
2 rules 5 TTPsAdversaries may conceal malicious code in compiled HTML files (.chm) and deliver them to a victim for execution, using the HTML Help executable (hh.exe) to proxy the execution of scripting interpreters and bypass security controls.
Microsoft HTML Help system +5
execution
defense-evasion
compiled-html
windows
proxy-execution
2r
5t
medium
advisory
Execution via Compiled HTML File
2 rules 6 TTPsAdversaries may abuse compiled HTML files (.chm) to execute malicious code by proxying execution via hh.exe, often leading to command execution via scripting interpreters.
compiled-html
execution
defense-evasion
windows
2r
6t