WebDav Client Execution Via Rundll32.EXE

Title: WebDav Client Execution Via Rundll32.EXE
Status: test
Description:Detects "svchost.exe" spawning "rundll32.exe" with command arguments like "C:\windows\system32\davclnt.dll,DavSetCookie". This could be an indicator of exfiltration or use of WebDav to launch code (hosted on a WebDav server).
References:
  -https://github.com/OTRF/detection-hackathon-apt29/issues/17
  -https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/7.B.4_C10730EA-6345-4934-AA0F-B0EFCA0C4BA6.md
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-05-02
modified:2023-09-18
Tags:

• -'attack.exfiltration'
• -'attack.t1048.003'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_parent:
    ParentImage|endswith: '\svchost.exe'
  selection_img:
Image|endswith:'\rundll32.exe' OriginalFileName:'RUNDLL32.EXE'   selection_cli:
    CommandLine|contains: 'C:\windows\system32\davclnt.dll,DavSetCookie'
  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium