DLL Loaded from WebDav Share

[rule]
description = """
Identifies the load of a library from a WebDav Share. Adversaries may abuse this method to evade dropping malicious
files to victim file system.
"""
id = "7ae54ce7-e1c9-4cbc-8e59-0350e80e9530"
license = "Elastic License v2"
name = "DLL Loaded from WebDav Share"
os_list = ["windows"]
version = "1.0.9"

query = '''
library where dll.path : "\\Device\\Mup\\*\\DavWWWRoot\\*" and 
 process.executable != null and not startswith~(dll.name, process.name) and 
 not process.executable : "\\Device\\Mup\\*\\DavWWWRoot\\*" and 
 not dll.path : "\\Device\\Mup\\*.sharepoint.com@SSL\\DavWWWRoot\\*"
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.4.0"