Windows rundll32 WebDAV Client Execution (davclnt.dll DavSetCookie)

title: Windows rundll32 WebDAV Client Execution (davclnt.dll DavSetCookie)
id: dc0327bf-8a03-4cb5-adc4-dd45cbdb0e87
status: test
description: This rule identifies svchost.exe spawning rundll32.exe with a command line containing the WebDAV client library function DavSetCookie from davclnt.dll. Such execution can indicate automated WebDAV access that may be leveraged to facilitate data movement or launch behaviors via a remote WebDAV context. It relies on Windows process creation telemetry, including the parent/child image paths and the rundll32 command line content.
references:
  - https://github.com/OTRF/detection-hackathon-apt29/issues/17
  - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/7.B.4_C10730EA-6345-4934-AA0F-B0EFCA0C4BA6.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_webdav_client_execution.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2020-05-02
modified: 2023-09-18
tags:
  - attack.exfiltration
  - attack.t1048.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \svchost.exe
  selection_img:
    - Image|endswith: \rundll32.exe
    - OriginalFileName: RUNDLL32.EXE
  selection_cli:
    CommandLine|contains: C:\windows\system32\davclnt.dll,DavSetCookie
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 2dbd9d3d-9e27-42a8-b8df-f13825c6c3d5
    type: derived