attack.t1218.001

OneNote.EXE Execution of Malicious Embedded Scripts

Sep 2, 2024 · attack.defense-evasion attack.t1218.001 ·

Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a OneNote attachment and then on the malicious link inside the ".one" file, it exports and executes the malicious embedded script from specific directories.

HH.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.t1218.001 ·

Share on:

Detects the execution of "hh.exe" to open ".chm" files.

HTML Help HH.EXE Suspicious Child Process

Aug 12, 2024 · attack.defense-evasion attack.execution attack.initial-access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·

Share on:

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

Remote CHM File Download/Execution Via HH.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.001 ·

Share on:

Detects the usage of "hh.exe" to execute/download remotely hosted ".chm" files.

Suspicious HH.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.execution attack.initial-access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·

Share on:

Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

HH.exe LOLBA executing .chm files

Aug 10, 2024 · attack.Compiled.HTML.File attack.T1218.001 ·

Share on:

Detecting the execution of hh.exe and the follow up activity for downloading or executing second stage payloads. This is based malspam activity delivering Remote Access Trojans via initial .chm payloads.

Onenote execution of malicious embedded scripts

Aug 10, 2024 · attack.defense_evasion attack.T1218.001 ·

Share on:

Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a onenote attachment and then on the malicious link inside the .one file, it exports and executes the malicious embedded script from specific directories.