Compiled HTML (help file) makes network connections

BIOC Informational

Compiled HTML (help file) makes network connections

Compiled HTML (help files) should not normally need to connect to the network. This may have limited legitimate uses, yet this behavior is often observed by malware leveraging malicious CHM files to deliver a 2nd stage payload.

Module:: Platform Analytics
Agent event type:: Network
Category:: Execution
Status:: Enabled

ATT&CK tactics: Defense Evasion (TA0005)

ATT&CK techniques: System Binary Proxy Execution: Compiled HTML File (T1218.001)

Indicator:

Network action type = outgoing , failed Process os parent name = hh.exe

Preventable: yes