Windows Suspicious cmd.exe Launch After net use Mounting WebDAV Share

Flags cmd.exe command lines that mount an Internet WebDAV share with net use and immediately execute content from DavWWWRoot.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: pH-T (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-09-01
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches process creation events where cmd.exe runs a command sequence that mounts an HTTP WebDAV share using net use and then immediately starts execution from the mapped WebDAV path (\DavWWWRoot\). The pattern is characteristic of malicious LNK-driven execution that retrieves and runs payloads hosted on remote shares. It relies on Windows process creation telemetry, including Image/OriginalFileName and full CommandLine content.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Suspicious PowerShell Spawning mshta for Malware Execution (via process_creation)

Malicious SolarWinds BusinessLayerHost Spawning Suspicious Child Process (SUNBURST) (via process_creation)

Suspicious word_update.exe Spawning Command Shell in Remcos Chain (via process_creation)

Malicious Remote HTA Download and Execution via mshta by UAC-0050 (via process_creation)

Suspicious IIS Worker Process Spawning Command or Scripting Interpreter via SharePoint ToolShell Exploitation (via process_creation)

Suspicious PowerShell Download Cradle Spawned from Explorer via ClickFix Lure (via process_creation)

Malicious Interlock RAT FileFix Download-Cradle via PowerShell WebClient with PowerShell User-Agent (via ps_script)

Malicious Metasploit Stager Delivery via mshta Remote HTA (via process_creation)

Suspicious PowerShell Download of Disguised Payload to ProgramData

Windows Suspicious cmd.exe Launch After net use Mounting WebDAV Share

Pivot detection · T1059.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-suspicious-cmd-exe-execution-from-internet-hosted-webdav-via-net-use-f0507c0f

title: Windows Suspicious cmd.exe Launch After net use Mounting WebDAV Share
id: 85103b75-c729-4ce9-8c1d-7c578eb967ac
status: test
description: This rule matches process creation events where cmd.exe runs a command sequence that mounts an HTTP WebDAV share using net use and then immediately starts execution from the mapped WebDAV path (\DavWWWRoot\). The pattern is characteristic of malicious LNK-driven execution that retrieves and runs payloads hosted on remote shares. It relies on Windows process creation telemetry, including Image/OriginalFileName and full CommandLine content.
references:
  - https://twitter.com/ShadowChasing1/status/1552595370961944576
  - https://www.virustotal.com/gui/file/a63376ee1dba76361df73338928e528ca5b20171ea74c24581605366dcaa0104/behavior
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_net_use_and_exec_combo.yml
author: pH-T (Nextron Systems), Huntrule Team
date: 2022-09-01
modified: 2023-02-21
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|contains: \cmd.exe
    - OriginalFileName: Cmd.EXE
  selection_base:
    CommandLine|contains|all:
      - " net use http"
      - "& start /b "
      - \DavWWWRoot\
  selection_ext:
    CommandLine|contains:
      - ".exe "
      - ".dll "
      - ".bat "
      - ".vbs "
      - ".ps1 "
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f0507c0f-a3a2-40f5-acc6-7f543c334993
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL