T1218.001 — Compiled HTML File

Tactic: Stealth · Platforms: Windows

Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such…

Sub-technique of System Binary Proxy Execution (T1218).

Sigma detection rules (1)

T1218.001 System Binary Proxy Execution: Compiled HTML File

title: "T1218.001 System Binary Proxy Execution: Compiled HTML File"
id: 9f58afc8-6e46-4dec-9bdb-d49f9f617c3d
description: 'Detects execution of hh.exe with a .chm argument, indicating potential execution of a malicious Compiled HTML Help file containing embedded scripting/ActiveX payloads. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: CHMPathRegex, ChildProcessList, NetworkDestinationAllowlist, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1218/001
author: Shahrukh Khan
date: 2026-01-26
license: MIT
tags:
  - attack.stealth
  - attack.t1218.001

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 1
    Image|endswith: '\hh.exe'
    CommandLine|contains: '.chm'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate use of Windows Help/CHM documentation opened via hh.exe.

level: medium

Related sub-techniques

Explore