Windows svchost.exe Spawning rundll32.exe with WebDav davclnt.dll DavSetCookie

title: Windows svchost.exe Spawning rundll32.exe with WebDav davclnt.dll DavSetCookie
id: e1fda7dc-d546-4f07-a160-61cf93d20d60
status: test
description: This rule flags process creation where svchost.exe (with WebClient service context) spawns rundll32.exe executing davclnt.dll with the DavSetCookie argument. This pattern is significant because it indicates WebDav client activity being used to trigger code execution, potentially enabling data exfiltration via a WebDav server or supporting exploitation workflows. The detection relies on Windows process creation telemetry, including parent image/command line and the child rundll32 command line containing the davclnt.dll and DavSetCookie string, plus an external (non-local) IP/URL indicator.
references:
  - https://twitter.com/aceresponder/status/1636116096506818562
  - https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/
  - https://www.pwndefend.com/2023/03/15/the-long-game-persistent-hash-theft/
  - https://www.microsoft.com/en-us/security/blog/wp-content/uploads/2023/03/Figure-7-sample-webdav-process-create-event.png
  - https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_webdav_client_susp_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems), Huntrule Team
date: 2023-03-16
modified: 2023-09-18
tags:
  - attack.exfiltration
  - attack.t1048.003
  - cve.2023-23397
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \svchost.exe
    ParentCommandLine|contains: -s WebClient
    Image|endswith: \rundll32.exe
    CommandLine|contains: C:\windows\system32\davclnt.dll,DavSetCookie
    CommandLine|re: ://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}
  filter_local_ips:
    CommandLine|contains:
      - ://10.
      - ://192.168.
      - ://172.16.
      - ://172.17.
      - ://172.18.
      - ://172.19.
      - ://172.20.
      - ://172.21.
      - ://172.22.
      - ://172.23.
      - ://172.24.
      - ://172.25.
      - ://172.26.
      - ://172.27.
      - ://172.28.
      - ://172.29.
      - ://172.30.
      - ://172.31.
      - ://127.
      - ://169.254.
  condition: selection and not 1 of filter_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 982e9f2d-1a85-4d5b-aea4-31f5e97c6555
    type: derived