1200KM / detection
T1218.001 Compiled HTML File — Detection Rules
Detection workspace for T1218.001 Compiled HTML File: 5 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- HH.EXE Execution · test · low · {"category":"process_creation","product":"windows"}
- Remote CHM File Download/Execution Via HH.EXE · test · high · {"category":"process_creation","product":"windows"}
- HTML Help HH.EXE Suspicious Child Process · test · high · {"category":"process_creation","product":"windows"}
- Suspicious HH.EXE Execution · test · high · {"category":"process_creation","product":"windows"}
- OneNote.EXE Execution of Malicious Embedded Scripts · test · high · {"category":"process_creation","product":"windows"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0342 Detection of Suspicious Compiled HTML File Execution via hh.exe
AN0968 Analytic 0968
Execution of hh.exe to open a .chm file followed by suspicious child processes or script engine invocation (VBScript, JScript, mshta, powershell). Behavior includes loading a CHM file from untrusted locations, or immediately spawning commands indicative of payload execution.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1218.001 simulation workspace
- File Creation · DC0039
- Module Load · DC0016
- Network Connection Creation · DC0082
- Process Creation · DC0032
No reviewed association in this snapshot.
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.