Windows svchost.exe Spawning rundll32.exe with WebDav davclnt.dll DavSetCookie
Alerts on svchost.exe launching rundll32.exe to run davclnt.dll DavSetCookie for WebDav over a non-local IP.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-03-16
- Updated
- 2026-07-30
ATT&CK techniques
ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Impact
What it detects
This rule flags process creation where svchost.exe (with WebClient service context) spawns rundll32.exe executing davclnt.dll with the DavSetCookie argument. This pattern is significant because it indicates WebDav client activity being used to trigger code execution, potentially enabling data exfiltration via a WebDav server or supporting exploitation workflows. The detection relies on Windows process creation telemetry, including parent image/command line and the child rundll32 command line containing the davclnt.dll and DavSetCookie string, plus an external (non-local) IP/URL indicator.
Reporting behind it
- twitter.comhttps://twitter.com/aceresponder/status/1636116096506818562
- mdsec.co.ukhttps://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/
- pwndefend.comhttps://www.pwndefend.com/2023/03/15/the-long-game-persistent-hash-theft/
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/wp-content/uploads/2023/03/Figure-7-sample-webdav-process-create-event.png
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_webdav_client_susp_execution.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows svchost.exe Spawning rundll32.exe with WebDav davclnt.dll DavSetCookie
id: e1fda7dc-d546-4f07-a160-61cf93d20d60
status: test
description: This rule flags process creation where svchost.exe (with WebClient service context) spawns rundll32.exe executing davclnt.dll with the DavSetCookie argument. This pattern is significant because it indicates WebDav client activity being used to trigger code execution, potentially enabling data exfiltration via a WebDav server or supporting exploitation workflows. The detection relies on Windows process creation telemetry, including parent image/command line and the child rundll32 command line containing the davclnt.dll and DavSetCookie string, plus an external (non-local) IP/URL indicator.
references:
- https://twitter.com/aceresponder/status/1636116096506818562
- https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/
- https://www.pwndefend.com/2023/03/15/the-long-game-persistent-hash-theft/
- https://www.microsoft.com/en-us/security/blog/wp-content/uploads/2023/03/Figure-7-sample-webdav-process-create-event.png
- https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_webdav_client_susp_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems), Huntrule Team
date: 2023-03-16
modified: 2023-09-18
tags:
- attack.exfiltration
- attack.t1048.003
- cve.2023-23397
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \svchost.exe
ParentCommandLine|contains: -s WebClient
Image|endswith: \rundll32.exe
CommandLine|contains: C:\windows\system32\davclnt.dll,DavSetCookie
CommandLine|re: ://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}
filter_local_ips:
CommandLine|contains:
- ://10.
- ://192.168.
- ://172.16.
- ://172.17.
- ://172.18.
- ://172.19.
- ://172.20.
- ://172.21.
- ://172.22.
- ://172.23.
- ://172.24.
- ://172.25.
- ://172.26.
- ://172.27.
- ://172.28.
- ://172.29.
- ://172.30.
- ://172.31.
- ://127.
- ://169.254.
condition: selection and not 1 of filter_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 982e9f2d-1a85-4d5b-aea4-31f5e97c6555
type: derived