Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1218.001_compiled-html-file
Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code.
Passed 20 of 22 test cases with the skill, and 13 of 22 without it.
and 4 more in the full report
7 fixed13 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
What CVE identifier is associated with bypassing Device Guard UMCI using compiled HTML files as detailed in security research?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies CVE-2017-8625. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1218
Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. CHM content is displayed using underlying components of the Internet Explorer browser loaded by the HTML Help executable program (hh.exe).
A custom CHM file containing embedded payloads could be delivered to a victim then triggered by User Execution. CHM execution may also bypass application application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe.
Platforms: Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Uses hh.exe to execute a local compiled HTML Help payload. Upon execution calc.exe will open
Supported Platforms: windows
hh.exe "#{local_chm_file}"
test cases passed, vs 13 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.