Suspicious File Execution From Internet Hosted WebDav Share

calendar Aug 12, 2024 · attack.execution attack.t1059.001  ·
Share on: linkedin copy

Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content in it. As seen being used in malicious LNK files

Sigma rule (View on GitHub)

 1title: Suspicious File Execution From Internet Hosted WebDav Share
 2id: f0507c0f-a3a2-40f5-acc6-7f543c334993
 3status: test
 4description: Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content in it. As seen being used in malicious LNK files
 5references:
 6    - https://twitter.com/ShadowChasing1/status/1552595370961944576
 7    - https://www.virustotal.com/gui/file/a63376ee1dba76361df73338928e528ca5b20171ea74c24581605366dcaa0104/behavior
 8author: pH-T (Nextron Systems)
 9date: 2022-09-01
10modified: 2023-02-21
11tags:
12    - attack.execution
13    - attack.t1059.001
14logsource:
15    category: process_creation
16    product: windows
17detection:
18    selection_img:
19        - Image|contains: '\cmd.exe'
20        - OriginalFileName: 'Cmd.EXE'
21    selection_base:
22        CommandLine|contains|all:
23            - ' net use http'
24            - '& start /b '
25            - '\DavWWWRoot\'
26    selection_ext:
27        CommandLine|contains:
28            - '.exe '
29            - '.dll '
30            - '.bat '
31            - '.vbs '
32            - '.ps1 '
33    condition: all of selection_*
34falsepositives:
35    - Unknown
36level: high

References

Related rules

to-top