T1218.001sub-technique of T1218 System Binary Proxy Execution

Compiled HTML File

Windowsnothing on this site yetT1218.001 on attack.mitre.org

Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX.
MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detection of Suspicious Compiled HTML File Execution via hh.exe

Execution of hh.exe to open a.chm file followed by suspicious child processes or script engine invocation (VBScript, JScript, mshta, powershell). Behavior includes loading a CHM file from untrusted locations, or immediately spawning commands indicative of payload execution.

what reduces it

M1021 Restrict Web-Based Content. Consider blocking download/transfer and execution of potentially uncommon file types known to be used in adversary campaigns, such as CHM files
M1038 Execution Prevention. Consider using application control to prevent execution of hh.exe if it is not required for a given system or network to prevent potential misuse by adversaries.

the rest of T1218

T1218.002 Control Panel · not covered yet
T1218.003 CMSTP · not covered yet
T1218.004 InstallUtil · not covered yet
T1218.005 Mshta · not covered yet
T1218.007 Msiexec · not covered yet
T1218.008 Odbcconf · not covered yet
T1218.009 Regsvcs/Regasm · not covered yet
T1218.010 Regsvr32 · not covered yet
T1218.011 Rundll32 · 1 on this site
T1218.012 Verclsid · not covered yet
T1218.013 Mavinject · not covered yet
T1218.014 MMC · not covered yet
T1218.015 Electron Applications · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.