Hayabusa high test sigma

Suspicious WebDav Client Execution Via Rundll32.EXE

Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server) or potentially a sign of exploitation of CVE-2023-23397

View Source

Detection Logic

{
  "process_creation": {
    "EventID": 1,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": {
    "ParentImage
| endswith": "\\svchost.exe",
    "ParentCommandLine
| contains": "-s WebClient",
    "Image
| endswith": "\\rundll32.exe",
    "CommandLine
| contains": "C:\\windows\\system32\\davclnt.dll,DavSetCookie",
    "CommandLine
| re": "://\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}"
  },
  "filter_local_ips": {
    "CommandLine
| contains": [
      "://10.",
      "://192.168.",
      "://172.16.",
      "://172.17.",
      "://172.18.",
      "://172.19.",
      "://172.20.",
      "://172.21.",
      "://172.22.",
      "://172.23.",
      "://172.24.",
      "://172.25.",
      "://172.26.",
      "://172.27.",
      "://172.28.",
      "://172.29.",
      "://172.30.",
      "://172.31.",
      "://127.",
      "://169.254."
    ]
  },
  "condition": "process_creation and (selection and not 1 of filter_*)"
}

False Positives

⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...