huntrule

Windows Process Access indicating RCE attempt via CVE-2025-33053 and WebDAV-hosted payloads

Alerts when iediagcmd.exe or CustomShellHost.exe access WebDAV-hosted executables consistent with a potential RCE attempt.

FreeUnreviewedSigmahighv1
title: Windows Process Access indicating RCE attempt via CVE-2025-33053 and WebDAV-hosted payloads
id: f38b46da-ac78-4ac4-b436-dddcd85637a0
related:
  - id: abe06362-a5b9-4371-8724-ebd00cd48a04
    type: similar
  - id: 04fc4b22-91a6-495a-879d-0144fec5ec03
    type: similar
  - id: 9a2d8b3e-f5a1-4c68-9e21-7d9e1cf8a123
    type: derived
status: experimental
description: This rule flags process access where legitimate Windows binaries (iediagcmd.exe or CustomShellHost.exe) access executables on WebDAV/UNC paths that include the \DavWWWRoot\ location. It targets cases where the accessed target executable name matches common command or utility executables (e.g., route.exe, netsh.exe, ipconfig.exe) that an attacker may attempt to run from attacker-controlled remote content. The detection relies on Windows process access telemetry with SourceImage and TargetImage path information to identify suspicious remote file execution patterns.
references:
  - https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053
  - https://research.checkpoint.com/2025/stealth-falcon-zero-day/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-33053/proc_access_win_exploit_cve_2025_33053.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-06-13
tags:
  - attack.command-and-control
  - attack.execution
  - attack.stealth
  - attack.t1218
  - attack.lateral-movement
  - attack.t1105
  - detection.emerging-threats
  - cve.2025-33053
logsource:
  category: process_access
  product: windows
detection:
  selection_src:
    SourceImage:
      - C:\Program Files\internet explorer\iediagcmd.exe
      - C:\Windows\System32\CustomShellHost.exe
  selection_target_dir:
    - TargetImage|startswith: \\\\
    - TargetImage|contains: \DavWWWRoot\
  selection_target_exe:
    TargetImage|endswith:
      - \route.exe
      - \netsh.exe
      - \makecab.exe
      - \dxdiag.exe
      - \ipconfig.exe
      - \explorer.exe
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags process access where legitimate Windows binaries (iediagcmd.exe or CustomShellHost.exe) access executables on WebDAV/UNC paths that include the \DavWWWRoot\ location. It targets cases where the accessed target executable name matches common command or utility executables (e.g., route.exe, netsh.exe, ipconfig.exe) that an attacker may attempt to run from attacker-controlled remote content. The detection relies on Windows process access telemetry with SourceImage and TargetImage path information to identify suspicious remote file execution patterns.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.