Windows: Mounting Internet Hosted WebDAV Shares via net.exe

title: "Windows: Mounting Internet Hosted WebDAV Shares via net.exe"
id: cfda9c64-c19e-4495-9819-49feaf357575
status: test
description: This rule flags process executions where net.exe (or net1.exe) is used to mount an HTTP-based WebDAV share, indicated by command-line tokens including both ' use ' and ' http'. Attackers may use built-in Windows utilities to access remote resources over the network while blending in with legitimate administrative behavior. Detection relies on process creation telemetry, specifically the executable path/name and the command line contents.
references:
  - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_net_use_mount_internet_share.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-21
modified: 2023-07-25
tags:
  - attack.lateral-movement
  - attack.t1021.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \net.exe
        - \net1.exe
    - OriginalFileName:
        - net.exe
        - net1.exe
  selection_cli:
    CommandLine|contains|all:
      - " use "
      - " http"
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7e6237fe-3ddb-438f-9381-9bf9de5af8d0
    type: derived