detection-rules/rules/windows/execution_via_compiled_html_file.toml at main · Blue-infosec/detection-rules · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
[metadata]
creation_date = "2020/02/18"
ecs_version = ["1.4.0"]
maturity = "production"
updated_date = "2020/02/18"

[rule]
author = ["Elastic"]
description = """
Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal
malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable
program (hh.exe).
"""
false_positives = [
    """
    The HTML Help executable program (hh.exe) runs whenever a user clicks a compiled help (.chm) file or menu item that
    opens the help file inside the Help Viewer. This is not always malicious, but adversaries may abuse this technology
    to conceal malicious code.
    """,
]
index = ["winlogbeat-*"]
language = "kuery"
license = "Elastic License"
name = "Process Activity via Compiled HTML File"
risk_score = 21
rule_id = "e3343ab9-4245-4715-b344-e11c56b0a47f"
severity = "low"
tags = ["Elastic", "Windows"]
type = "query"

query = '''
event.code:1 and process.name:hh.exe
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1223"
name = "Compiled HTML File"
reference = "https://attack.mitre.org/techniques/T1223/"


[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1223"
name = "Compiled HTML File"
reference = "https://attack.mitre.org/techniques/T1223/"


[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"