Windows Process Creation: Possible CVE-2025-33053 WebDAV RCE via utility search-order manipulation
Flags suspicious child execution from WebDAV/UNC paths initiated by iediagcmd.exe or CustomShellHost.exe, consistent with CVE-2025-33053 exploitation.
- Product
- windows
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-06-13
- Updated
- 2026-07-31
ATT&CK techniques
Defense Evasion → C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies Windows process creation events consistent with potential remote code execution exploitation tied to CVE-2025-33053. It looks for iediagcmd.exe or CustomShellHost.exe launching follow-on executables (including route.exe, netsh.exe, makecab.exe, dxdiag.exe, ipconfig.exe, explorer.exe) where the current directory or image path involves attacker-controlled WebDAV locations such as \\DavWWWRoot\ or UNC paths. The behavior matters because it suggests an attacker may abuse legitimate utilities and working-directory/path resolution to run malicious binaries from a WebDAV share instead of expected system executables. Detection relies on process creation telemetry including parent image, current directory, and the child image path, with exclusions for child images under standard system directories.
Reporting behind it
- msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053
- research.checkpoint.comhttps://research.checkpoint.com/2025/stealth-falcon-zero-day/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-33053/proc_creation_win_exploit_cve_2025_33053.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Possible CVE-2025-33053 WebDAV RCE via utility search-order manipulation"
id: a74dc046-3f36-4aa6-adc7-7ee33c05f6b8
related:
- id: 9a2d8b3e-f5a1-4c68-9e21-7d9e1cf8a123
type: similar
- id: 04fc4b22-91a6-495a-879d-0144fec5ec03
type: similar
- id: abe06362-a5b9-4371-8724-ebd00cd48a04
type: derived
status: experimental
description: This rule identifies Windows process creation events consistent with potential remote code execution exploitation tied to CVE-2025-33053. It looks for iediagcmd.exe or CustomShellHost.exe launching follow-on executables (including route.exe, netsh.exe, makecab.exe, dxdiag.exe, ipconfig.exe, explorer.exe) where the current directory or image path involves attacker-controlled WebDAV locations such as \\DavWWWRoot\ or UNC paths. The behavior matters because it suggests an attacker may abuse legitimate utilities and working-directory/path resolution to run malicious binaries from a WebDAV share instead of expected system executables. Detection relies on process creation telemetry including parent image, current directory, and the child image path, with exclusions for child images under standard system directories.
references:
- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053
- https://research.checkpoint.com/2025/stealth-falcon-zero-day/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-33053/proc_creation_win_exploit_cve_2025_33053.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-06-13
tags:
- attack.command-and-control
- attack.execution
- attack.stealth
- attack.t1218
- attack.lateral-movement
- attack.t1105
- detection.emerging-threats
- cve.2025-33053
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage:
- C:\Program Files\internet explorer\iediagcmd.exe
- C:\Windows\System32\CustomShellHost.exe
selection_child_current_dir:
- CurrentDirectory|startswith: \\\\
- CurrentDirectory|contains: \DavWWWRoot\
- Image|contains: \DavWWWRoot\
- Image|startswith: \\\\
selection_child_img:
Image|endswith:
- \route.exe
- \netsh.exe
- \makecab.exe
- \dxdiag.exe
- \ipconfig.exe
- \explorer.exe
filter_main_system:
Image|startswith:
- C:\Windows\System32\
- C:\Windows\SysWOW64\
condition: all of selection_* and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1