Windows Process Access: Suspicious WebDAV target execution via iediagcmd.exe or CustomShellHost.exe (CVE-2025-33053)
Alerts when iediagcmd.exe or CustomShellHost.exe access WebDAV-hosted executables consistent with a potential RCE attempt.
- Product
- windows
- Category
- process_access
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-06-13
- Updated
- 2026-07-31
ATT&CK techniques
Defense Evasion → C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags potential exploitation of the remote code execution vulnerability CVE-2025-33053 by detecting process access where legitimate Windows executables (iediagcmd.exe or CustomShellHost.exe) access attacker-controlled WebDAV locations. The behavior is concerning because it may indicate manipulation of process startup/search order to cause execution of attacker-supplied content hosted on a remote WebDAV server. It relies on Windows process access telemetry showing the SourceImage and the TargetImage path that includes WebDAV (\\...\DavWWWRoot\) and ends with specific executable names.
Reporting behind it
- msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053
- research.checkpoint.comhttps://research.checkpoint.com/2025/stealth-falcon-zero-day/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-33053/proc_access_win_exploit_cve_2025_33053.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Access: Suspicious WebDAV target execution via iediagcmd.exe or CustomShellHost.exe (CVE-2025-33053)"
id: f38b46da-ac78-4ac4-b436-dddcd85637a0
related:
- id: abe06362-a5b9-4371-8724-ebd00cd48a04
type: similar
- id: 04fc4b22-91a6-495a-879d-0144fec5ec03
type: similar
- id: 9a2d8b3e-f5a1-4c68-9e21-7d9e1cf8a123
type: derived
status: experimental
description: This rule flags potential exploitation of the remote code execution vulnerability CVE-2025-33053 by detecting process access where legitimate Windows executables (iediagcmd.exe or CustomShellHost.exe) access attacker-controlled WebDAV locations. The behavior is concerning because it may indicate manipulation of process startup/search order to cause execution of attacker-supplied content hosted on a remote WebDAV server. It relies on Windows process access telemetry showing the SourceImage and the TargetImage path that includes WebDAV (\\...\DavWWWRoot\) and ends with specific executable names.
references:
- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053
- https://research.checkpoint.com/2025/stealth-falcon-zero-day/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-33053/proc_access_win_exploit_cve_2025_33053.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-06-13
tags:
- attack.command-and-control
- attack.execution
- attack.stealth
- attack.t1218
- attack.lateral-movement
- attack.t1105
- detection.emerging-threats
- cve.2025-33053
logsource:
category: process_access
product: windows
detection:
selection_src:
SourceImage:
- C:\Program Files\internet explorer\iediagcmd.exe
- C:\Windows\System32\CustomShellHost.exe
selection_target_dir:
- TargetImage|startswith: \\\\
- TargetImage|contains: \DavWWWRoot\
selection_target_exe:
TargetImage|endswith:
- \route.exe
- \netsh.exe
- \makecab.exe
- \dxdiag.exe
- \ipconfig.exe
- \explorer.exe
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1