{"id":"982e9f2d-1a85-4d5b-aea4-31f5e97c6555","title":"Suspicious WebDav Client Execution Via Rundll32.EXE","description":"Detects \"svchost.exe\" spawning \"rundll32.exe\" with command arguments like C:\\windows\\system32\\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server) or potentially a sign of exploitation of CVE-2023-23397\n","author":"Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2023-03-16","modified":"2023-09-18","tags":["attack.exfiltration","attack.t1048.003","cve.2023-23397"],"technique_ids":["T1048.003"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://twitter.com/aceresponder/status/1636116096506818562","https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/","https://www.pwndefend.com/2023/03/15/the-long-game-persistent-hash-theft/","https://www.microsoft.com/en-us/security/blog/wp-content/uploads/2023/03/Figure-7-sample-webdav-process-create-event.png","https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/"],"source_path":"rules/windows/process_creation/proc_creation_win_rundll32_webdav_client_susp_execution.yml","source_sha256":"ec0f71854a8f1de9ac18e1fb7b13db9d7c406f29d4e65034f7b7195922fb9ec7","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_rundll32_webdav_client_susp_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious WebDav Client Execution Via Rundll32.EXE\nid: 982e9f2d-1a85-4d5b-aea4-31f5e97c6555\nstatus: test\ndescription: |\n    Detects \"svchost.exe\" spawning \"rundll32.exe\" with command arguments like C:\\windows\\system32\\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server) or potentially a sign of exploitation of CVE-2023-23397\nreferences:\n    - https://twitter.com/aceresponder/status/1636116096506818562\n    - https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/\n    - https://www.pwndefend.com/2023/03/15/the-long-game-persistent-hash-theft/\n    - https://www.microsoft.com/en-us/security/blog/wp-content/uploads/2023/03/Figure-7-sample-webdav-process-create-event.png\n    - https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/\nauthor: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)\ndate: 2023-03-16\nmodified: 2023-09-18\ntags:\n    - attack.exfiltration\n    - attack.t1048.003\n    - cve.2023-23397\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\svchost.exe'\n        ParentCommandLine|contains: '-s WebClient'\n        Image|endswith: '\\rundll32.exe'\n        CommandLine|contains: 'C:\\windows\\system32\\davclnt.dll,DavSetCookie'\n        CommandLine|re: '://\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}'\n    filter_local_ips:\n        CommandLine|contains:\n            - '://10.' # 10.0.0.0/8\n            - '://192.168.' # 192.168.0.0/16\n            - '://172.16.' # 172.16.0.0/12\n            - '://172.17.'\n            - '://172.18.'\n            - '://172.19.'\n            - '://172.20.'\n            - '://172.21.'\n            - '://172.22.'\n            - '://172.23.'\n            - '://172.24.'\n            - '://172.25.'\n            - '://172.26.'\n            - '://172.27.'\n            - '://172.28.'\n            - '://172.29.'\n            - '://172.30.'\n            - '://172.31.'\n            - '://127.' # 127.0.0.0/8\n            - '://169.254.' # 169.254.0.0/16\n    condition: selection and not 1 of filter_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1048.003","id":"T1048.003","name":"Exfiltration Over Unencrypted Non-C2 Protocol","page":"techniques/enterprise/T1048.003/"}],"data_path":"data/detection-rules/982e9f2d-1a85-4d5b-aea4-31f5e97c6555.json","kind":"sigma"}