Suspicious Execution from a WebDav Share

  1[metadata]
  2creation_date = "2025/08/19"
  3integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies attempts to execute or invoke content from remote WebDAV shares. Adversaries may abuse WebDAV paths,
 11public tunnels, or host@port UNC paths to run tools or scripts while reducing local staging on the victim file system.
 12"""
 13false_positives = [
 14    "Trusted WebDAV content when the command namespace, parent, utility identity, signer, user/host scope, and child/artifact/destination evidence align with a recognized workflow"
 15]
 16from = "now-9m"
 17index = [
 18    "endgame-*",
 19    "logs-crowdstrike.fdr*",
 20    "logs-endpoint.events.process-*",
 21    "logs-m365_defender.event-*",
 22    "logs-sentinel_one_cloud_funnel.*",
 23    "logs-system.security*",
 24    "logs-windows.forwarded*",
 25    "logs-windows.sysmon_operational-*",
 26    "winlogbeat-*",
 27]
 28language = "eql"
 29license = "Elastic License v2"
 30name = "Suspicious Execution from a WebDav Share"
 31risk_score = 73
 32rule_id = "ee7726cc-babc-4885-988c-f915173ac0c0"
 33severity = "high"
 34tags = [
 35    "Domain: Endpoint",
 36    "OS: Windows",
 37    "Use Case: Threat Detection",
 38    "Tactic: Execution",
 39    "Data Source: Elastic Endgame",
 40    "Data Source: Elastic Defend",
 41    "Data Source: Windows Security Event Logs",
 42    "Data Source: Microsoft Defender XDR",
 43    "Data Source: Sysmon",
 44    "Data Source: SentinelOne",
 45    "Data Source: Crowdstrike",
 46    "Resources: Investigation Guide",
 47    "Noise: Low",
 48    "Performance: Normal",
 49    "Profile: Recommended",
 50    "Threat: WebDAV Abuse",
 51    "Rule Type: Event Correlation (EQL)",
 52    "Platform: Windows",
 53]
 54timestamp_override = "event.ingested"
 55type = "eql"
 56
 57query = '''
 58process where host.os.type == "windows" and event.type == "start" and
 59 process.name : ("cmd.exe", "powershell.exe", "conhost.exe", "wscript.exe", "mshta.exe", "curl.exe", "msiexec.exe", "bitsadmin.exe", "net.exe") and
 60 process.command_line : ("*trycloudflare.com*", "*@SSL\\*", "*\\webdav\\*", "*\\DavWWWRoot\\*", "*\\\\*.*@8080\\*", "*\\\\*.*@80\\*", "*\\\\*.*@8443\\*", "*\\\\*.*@443\\*") and
 61 not (process.name : "cmd.exe" and process.args : "\\\\?\\UNC\\*.sharepoint.com@SSL\\DavWWWRoot\\*")
 62'''
 63
 64note = """## Triage and analysis
 65
 66### Investigating Suspicious Execution from a WebDav Share
 67
 68#### Possible investigation steps
 69
 70- Does the alert command line show direct WebDAV execution, and external delivery vs internal transfer?
 71  - Focus: `process.command_line`, `process.name`, and `process.executable`; separate public tunnel or tenant paths from internal host@port UNC, "@SSL", "DavWWWRoot", or high-port paths.
 72  - Implication: escalate when a script host, installer, shell, transfer tool, or net.exe points to public WebDAV content or an unrelated internal transfer host; lower concern when path maps to one recognized internal tenant, vendor, or deployment namespace for that role.
 73
 74- Do the launcher identity and parent lineage match that exact workflow?
 75  - Focus: `process.executable`, `process.code_signature.subject_name`, `process.code_signature.trusted`, `process.parent.executable`, and `process.parent.command_line`.
 76  - Implication: escalate when a signed utility proxies execution from a browser, Office app, chat client, archive tool, or unexplained service context. Public paths from user-facing parents suggest user delivery; internal host@port paths or net.exe share activity suggest lateral transfer. Lower concern when signer, parent, path, host, and user recur as one recognized collaboration, deployment, or support workflow; identity alone does not clear remote execution.
 77
 78- Did the alerting process spawn follow-on execution or share-mount activity?
 79  - Focus: child or sibling process starts on `host.id` where `process.parent.entity_id` matches `process.entity_id`; check shells, downloaders, installers, schedulers, net.exe, or user-writable `process.executable` paths. $investigate_2
 80  - Hint: if `process.entity_id` is unavailable, use `host.id`, `process.pid`, and a tight alert-time window; PID lineage is weaker because of reuse.
 81  - Implication: escalate when the launcher spawns download, install, persistence, or share-mapping tied to the same path; narrow scope when the chain ends cleanly inside one recognized workflow.
 82
 83- Did file telemetry show local staging or later execution from the WebDAV launch?
 84  - Focus: if file telemetry exists, query `host.id` plus `process.entity_id` for `file.path`, `file.origin_url`, `file.Ext.windows.zone_identifier`, and later starts where `process.executable` matches a written path. $investigate_3
 85  - Hint: if WebDAV content is copied locally or to a mapped drive before execution, treat it as the same delivery chain and keep original-process scope.
 86  - Range: start with the alert window; expand only after a suspicious write to confirm later execution.
 87  - Implication: escalate when the chain writes scripts, installers, renamed payloads, or startup material in user-writable paths. Missing file telemetry is unresolved, not benign; direct WebDAV execution may leave few local artifacts.
 88
 89- Did DNS or connection telemetry confirm the WebDAV endpoint or delivery infrastructure?
 90  - Focus: if network telemetry exists, separate DNS events (`dns.question.name`, `dns.resolved_ip`) from connection events (`destination.ip`, `destination.port`) for the same `host.id` and `process.entity_id`. $investigate_4
 91  - Hint: use DNS lookup_result events to map `dns.resolved_ip` to later `destination.ip` before tying a domain to a connection. Missing network telemetry is unresolved, not benign.
 92  - Implication: escalate when the process reaches public tunnels, rare external domains, high-port WebDAV services, or destinations unrelated to the signer and parent workflow; lower concern when the endpoint matches the command line's recognized tenant, internal share, or vendor.
 93
 94- If local evidence is suspicious or unresolved, do related alerts show the same WebDAV delivery or transfer pattern?
 95  - Focus: related alerts for `user.id` over 48 hours, checking reused WebDAV path, launcher, destination, or follow-on artifact. $investigate_0
 96  - Hint: if user scope is quiet or ambiguous, check `host.id` for whether the path stays local or appears with other execution or download alerts. $investigate_1
 97  - Implication: broaden scope when the same path, domain, launcher, or artifact pattern appears beyond one recognized workflow; keep the case local when related-alert history is confined to that workflow.
 98
 99- Escalate on direct remote WebDAV execution plus suspicious launcher, lineage, child, artifact, destination, or related-alert evidence; close only when process evidence and recovery align to one exact recognized workflow; preserve and escalate when answers conflict or visibility is incomplete.
100
101### False positive analysis
102
103- Tenant collaboration portals, internal WebDAV shares, and vendor content portals can trigger when `process.command_line` namespace, `process.parent.executable`, `process.executable`, signer, `user.id`, and `host.id` converge on one recognized workflow. Close only when telemetry shows parent, path, utility, user, and host stable across prior rule alerts and no child, artifact, or destination evidence contradicts the portal workflow. Use portal allowlists or owner records as corroboration, not substitutes.
104- Deployment or remote-support tooling can run msiexec.exe, powershell.exe, cmd.exe, or bitsadmin.exe against WebDAV-hosted packages. Confirm only when a management-agent or support-console parent, utility identity, signer, package namespace, written-artifact pattern, and host/user scope fit the same workflow. Public tunnel paths, renamed payloads, unexpected children, or one-off standard-user launches remain suspicious unless externally confirmed with no telemetry contradictions.
105- Before creating an exception, use the minimum confirmed workflow pattern: stable `process.code_signature.subject_name` or `process.executable`, `process.parent.executable`, specific `process.command_line` namespace or destination pattern, and proving `user.id` or `host.id` scope. Avoid exceptions on `process.name`, `user.name`, "@SSL", or "DavWWWRoot" alone.
106
107### Response and remediation
108
109- If confirmed benign, reverse temporary containment and document the command-line namespace, parent launcher, utility identity, signer, available destination or artifact evidence, and `user.id` / `host.id` scope that validated the workflow. Create an exception only after the same scoped pattern is stable across prior rule alerts.
110- If suspicious but unconfirmed, preserve the alert export, process tree, `process.entity_id`, `process.command_line`, `process.parent.command_line`, remote path, staged artifacts, and destination indicators before containment. First apply reversible containment, such as temporarily blocking the confirmed WebDAV namespace or increasing monitoring on affected `host.id` and `user.id`; avoid termination or deletion until child execution, payload staging, or repeated suspicious destinations indicate active compromise.
111- If confirmed malicious, isolate the host when feasible or terminate the alerting process after evidence capture. If identity evidence suggests account misuse, contain or reset the affected account with identity owners. If direct endpoint response is unavailable, hand off preserved process, artifact, destination, host, and user evidence to the team able to contain the host or account.
112- Block confirmed malicious domains, destination IPs, hashes, executable paths, and staged artifact paths. Review other hosts and users for the same `process.parent.executable` plus `process.command_line` plus destination pattern, then remove only staged scripts, installers, startup material, or persistence changes tied to the chain.
113- Post-incident hardening: restrict unnecessary WebDAV and WebClient usage, limit direct execution from remote shares by script hosts and installers, use application control or attack surface reduction where feasible, retain file and network telemetry for this workflow, and document variants such as mapped-drive execution, copied-local execution, and alternate script-host launchers.
114"""
115
116setup = """## Setup
117
118This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
119
120Setup instructions: https://ela.st/install-elastic-defend
121
122### Additional data sources
123
124This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
125
126- [CrowdStrike](https://ela.st/crowdstrike-integration)
127- [Microsoft Defender XDR](https://ela.st/m365-defender)
128- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
129- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
130- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
131"""
132
133[rule.investigation_fields]
134field_names = [
135    "@timestamp",
136    "host.name",
137    "host.id",
138    "user.id",
139    "process.entity_id",
140    "process.pid",
141    "process.name",
142    "process.executable",
143    "process.command_line",
144    "process.parent.executable",
145    "process.parent.command_line",
146    "process.code_signature.subject_name",
147    "process.code_signature.trusted",
148]
149
150[transform]
151
152[[transform.investigate]]
153label = "Alerts associated with the user"
154description = ""
155providers = [
156  [
157    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
158    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
159  ]
160]
161relativeFrom = "now-48h/h"
162relativeTo = "now"
163
164[[transform.investigate]]
165label = "Alerts associated with the host"
166description = ""
167providers = [
168  [
169    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
170    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
171  ]
172]
173relativeFrom = "now-48h/h"
174relativeTo = "now"
175
176[[transform.investigate]]
177label = "Child process events from the WebDAV launcher"
178description = ""
179providers = [
180  [
181    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
182    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
183    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
184  ]
185]
186relativeFrom = "now-1h"
187relativeTo = "now"
188
189[[transform.investigate]]
190label = "File events from the WebDAV launcher"
191description = ""
192providers = [
193  [
194    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
195    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
196    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
197  ]
198]
199relativeFrom = "now-1h"
200relativeTo = "now"
201
202[[transform.investigate]]
203label = "Network events from the WebDAV launcher"
204description = ""
205providers = [
206  [
207    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" },
208    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
209    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
210  ]
211]
212relativeFrom = "now-1h"
213relativeTo = "now"
214
215[[rule.threat]]
216framework = "MITRE ATT&CK"
217
218[[rule.threat.technique]]
219id = "T1204"
220name = "User Execution"
221reference = "https://attack.mitre.org/techniques/T1204/"
222
223[[rule.threat.technique.subtechnique]]
224id = "T1204.002"
225name = "Malicious File"
226reference = "https://attack.mitre.org/techniques/T1204/002/"
227
228[rule.threat.tactic]
229id = "TA0002"
230name = "Execution"
231reference = "https://attack.mitre.org/tactics/TA0002/"
232
233[[rule.threat]]
234framework = "MITRE ATT&CK"
235
236[[rule.threat.technique]]
237id = "T1021"
238name = "Remote Services"
239reference = "https://attack.mitre.org/techniques/T1021/"
240
241[[rule.threat.technique.subtechnique]]
242id = "T1021.002"
243name = "SMB/Windows Admin Shares"
244reference = "https://attack.mitre.org/techniques/T1021/002/"
245
246[[rule.threat.technique]]
247id = "T1570"
248name = "Lateral Tool Transfer"
249reference = "https://attack.mitre.org/techniques/T1570/"
250
251[rule.threat.tactic]
252id = "TA0008"
253name = "Lateral Movement"
254reference = "https://attack.mitre.org/tactics/TA0008/"
255
256[[rule.threat]]
257framework = "MITRE ATT&CK"
258
259[[rule.threat.technique]]
260id = "T1071"
261name = "Application Layer Protocol"
262reference = "https://attack.mitre.org/techniques/T1071/"
263
264[[rule.threat.technique.subtechnique]]
265id = "T1071.001"
266name = "Web Protocols"
267reference = "https://attack.mitre.org/techniques/T1071/001/"
268
269[[rule.threat.technique]]
270id = "T1105"
271name = "Ingress Tool Transfer"
272reference = "https://attack.mitre.org/techniques/T1105/"
273
274[rule.threat.tactic]
275id = "TA0011"
276name = "Command and Control"
277reference = "https://attack.mitre.org/tactics/TA0011/"