ATT&CK technique
View on MITRE ATT&CK →
T1218.001
Compiled HTML File
Stealth
14 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | Detect HTML Help Spawn Child Process | production | 2026-10-09 |
| splunk | Windows System Binary Proxy Execution Compiled HTML File Decompile | production | 2026-10-09 |
| splunk | Detect HTML Help Using InfoTech Storage Handlers | production | 2026-10-02 |
| splunk | Detect HTML Help URL in Command Line | production | 2026-10-02 |
| splunk | Detect HTML Help Renamed | deprecated | 2026-09-23 |
| elastic | Process Activity via Compiled HTML File | production | 2026-09-18 |
| elastic | Network Connection via Compiled HTML File | production | 2026-09-18 |
| elastic | Suspicious MS Office Child Process | production | 2026-09-18 |
| sigma | Remote CHM File Download/Execution Via HH.EXE | test | 2024-01-31 |
| sigma | HH.EXE Execution | test | 2023-12-11 |
| sigma | Suspicious HH.EXE Execution | test | 2023-04-12 |
| sigma | HTML Help HH.EXE Suspicious Child Process | test | 2023-04-12 |
| sigma | OneNote.EXE Execution of Malicious Embedded Scripts | test | 2023-02-02 |
| sigma | HH.EXE Initiated HTTP Network Connection | test | 2022-10-05 |