HUNTS- Compiled HTML File (T1223)

HUNTS- Compiled HTML File (T1223)

Version 1.0

ATT&CK Technique: Compiled HTML File (T1223)

What this playbook hunts for:

• Processes spawned by hh.exe. HH.exe is used to open compiled HTML files. Compiled HTML files are commonly associated with Microsoft’s help system, but can also be abused to execute various scripting languages contained in the files’ HTML bodies. HH.exe is an example of a Living of the Land (LOL) binary, which are native Windows executables that are rarely blocked by Applocker or anti-virus software.

How the playbook works:

• Generates SIEM query for Sysmon Event ID 1 logs where hh.exe is a parent process.

What results are expected:

• Name, process ID, and path of the process spawned by hh.exe.

• Command line arguments for hh.exe and its child process

• MD5 hash of the process spawned by hh.exe

• Child process spawn time

• Hostname of the computer where the child process was spawned

• User account that was used to execute the child process

Common follow-on actions:

• Acquire forensic image

• Sandbox file

• Get running processes

• Get network connections

• Quarantine host

What inputs are necessary:

• SIEM

• Logs: Sysmon Event ID 1: Process creation

• Hunt start time

What subroutine playbooks are needed:

• Create and Link Alerts from Hunt (Host-based)

What configurations are needed:

• Sysmon logging enabled 

False Positive Potential: Low

• Execution of hh.exe is uncommon on most networks. Child processes spawned by hh.exe are even more uncommon and should absolutely be investigated if observed.