Potentially Suspicious WebDAV LNK Execution

Title: Potentially Suspicious WebDAV LNK Execution
Status: test
Description:Detects possible execution via LNK file accessed on a WebDAV server.
References:
  -https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html
  -https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462
Author: Micah Babinski
Date: 2023-08-21
modified:None
Tags:

• -'attack.execution'
• -'attack.t1059.001'
• -'attack.t1204'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    ParentImage|endswith: '\explorer.exe'
    Image|endswith:
      -'\cmd.exe'
      -'\cscript.exe'
      -'\mshta.exe'
      -'\powershell.exe'
      -'\pwsh.exe'
      -'\wscript.exe'

    CommandLine|contains: '\DavWWWRoot\'
  condition:selection
Falsepositives:
  -Unknown
Level: medium