huntrule

Windows suspicious cmd.exe execution from Internet-hosted WebDAV via net use

Flags cmd.exe command lines that mount an Internet WebDAV share with net use and immediately execute content from DavWWWRoot.

FreeUnreviewedSigmahighv1
title: Windows suspicious cmd.exe execution from Internet-hosted WebDAV via net use
id: 85103b75-c729-4ce9-8c1d-7c578eb967ac
status: test
description: This rule identifies process executions where cmd.exe runs a sequence that mounts an Internet WebDAV share using the net use http command and then starts execution of content located under the DavWWWRoot path. Attackers commonly use this pattern to stage and run remote payloads from web-accessible storage while blending into normal command interpreter activity. It relies on Windows process creation telemetry, matching specific command-line substrings for the net use and start sequence, plus indicators of executable, script, or library extensions being launched.
references:
  - https://twitter.com/ShadowChasing1/status/1552595370961944576
  - https://www.virustotal.com/gui/file/a63376ee1dba76361df73338928e528ca5b20171ea74c24581605366dcaa0104/behavior
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_net_use_and_exec_combo.yml
author: pH-T (Nextron Systems), Huntrule Team
date: 2022-09-01
modified: 2023-02-21
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|contains: \cmd.exe
    - OriginalFileName: Cmd.EXE
  selection_base:
    CommandLine|contains|all:
      - " net use http"
      - "& start /b "
      - \DavWWWRoot\
  selection_ext:
    CommandLine|contains:
      - ".exe "
      - ".dll "
      - ".bat "
      - ".vbs "
      - ".ps1 "
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f0507c0f-a3a2-40f5-acc6-7f543c334993
    type: derived

What it detects

This rule identifies process executions where cmd.exe runs a sequence that mounts an Internet WebDAV share using the net use http command and then starts execution of content located under the DavWWWRoot path. Attackers commonly use this pattern to stage and run remote payloads from web-accessible storage while blending into normal command interpreter activity. It relies on Windows process creation telemetry, matching specific command-line substrings for the net use and start sequence, plus indicators of executable, script, or library extensions being launched.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.