Windows Process Execution Triggered from WebDAV LNK Paths

title: Windows Process Execution Triggered from WebDAV LNK Paths
id: b67c5318-faec-44bb-88fb-aba3c971d90b
related:
  - id: f0507c0f-a3a2-40f5-acc6-7f543c334993
    type: similar
  - id: 1412aa78-a24c-4abd-83df-767dfb2c5bbe
    type: derived
status: test
description: This rule flags Windows process executions where the parent is explorer.exe and the spawned binary is a command interpreter or script host, with the command line containing a WebDAV directory path (\DavWWWRoot\). WebDAV-published shortcuts can be abused to lead users or processes into launching attacker-controlled content and commands. The detection relies on process creation telemetry, specifically parent image, process image, and the command line string.
references:
  - https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html
  - https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_webdav_lnk_execution.yml
author: Micah Babinski, Huntrule Team
date: 2023-08-21
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \explorer.exe
    Image|endswith:
      - \cmd.exe
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \wscript.exe
    CommandLine|contains: \DavWWWRoot\
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1