Windows Rundll32 Calls DavSetCookie for NTLM Coercion via Spoolss/Srvsvc
Detects rundll32.exe launching davclnt.dll DavSetCookie with HTTP and spoolss/srvsvc pipe parameters associated with NTLM coercion.
- Product
- windows
- Category
- process_creation
- Author
- Elastic (idea), Tobias Michalski (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-05-04
- Updated
- 2026-07-30
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process execution of rundll32.exe invoking davclnt.dll,DavSetCookie with HTTP-related parameters tied to spoolss and srvsvc named-pipe targeting. This behavior can be used to coerce an NTLM authentication attempt through the Printer Spooler/SMB print service pathway, which may enable credential relay and privilege escalation. It relies on process creation telemetry, matching rundll32 image details and specific command-line substrings used in the invocation.
Reporting behind it
- twitter.comhttps://twitter.com/med0x2e/status/1520402518685200384
- github.comhttps://github.com/elastic/detection-rules/blob/dd224fb3f81d0b4bf8593c5f02a029d647ba2b2d/rules/windows/credential_access_relay_ntlm_auth_via_http_spoolss.toml
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_ntlmrelay.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Rundll32 Calls DavSetCookie for NTLM Coercion via Spoolss/Srvsvc
id: a5fd97ff-9c4c-47a9-bf7d-ba2a0f07d597
status: test
description: This rule flags process execution of rundll32.exe invoking davclnt.dll,DavSetCookie with HTTP-related parameters tied to spoolss and srvsvc named-pipe targeting. This behavior can be used to coerce an NTLM authentication attempt through the Printer Spooler/SMB print service pathway, which may enable credential relay and privilege escalation. It relies on process creation telemetry, matching rundll32 image details and specific command-line substrings used in the invocation.
references:
- https://twitter.com/med0x2e/status/1520402518685200384
- https://github.com/elastic/detection-rules/blob/dd224fb3f81d0b4bf8593c5f02a029d647ba2b2d/rules/windows/credential_access_relay_ntlm_auth_via_http_spoolss.toml
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_ntlmrelay.yml
author: Elastic (idea), Tobias Michalski (Nextron Systems), Huntrule Team
date: 2022-05-04
modified: 2023-02-09
tags:
- attack.privilege-escalation
- attack.credential-access
- attack.t1212
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \rundll32.exe
- OriginalFileName: RUNDLL32.EXE
selection_cli:
CommandLine|contains|all:
- C:\windows\system32\davclnt.dll,DavSetCookie
- http
CommandLine|contains:
- spoolss
- srvsvc
- /print/pipe/
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: bb76d96b-821c-47cf-944b-7ce377864492
type: derived