Detectionhightest

Suspicious File Execution From Internet Hosted WebDav Share

Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content in it. As seen being used in malicious LNK files

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Martin MuellerCreated Thu Sep 01Updated Tue Feb 21f0507c0f-a3a2-40f5-acc6-7f543c334993windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_img:
        - Image|contains: '\cmd.exe'
        - OriginalFileName: 'Cmd.EXE'
    selection_base:
        CommandLine|contains|all:
            - ' net use http'
            - '& start /b '
            - '\DavWWWRoot\'
    selection_ext:
        CommandLine|contains:
            - '.exe '
            - '.dll '
            - '.bat '
            - '.vbs '
            - '.ps1 '
    condition: all of selection_*