Potential Exploitation of RCE Vulnerability CVE-2025-33053

Status: experimental
Severity: high
Log source: category process_creation, product windows
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 which involves unauthorized code execution via WebDAV through external control of file names or paths. The exploit abuses legitimate utilities like iediagcmd.exe or CustomShellHost.exe by manipulating their working directories to point to attacker-controlled WebDAV servers, causing them to execute malicious executables (like route.exe) from the WebDAV path instead of legitimate system binaries through Process.Start() search order manipulation.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218` System Binary Proxy Execution
Command & Control	`T1105` Ingress Tool Transfer

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Potential Exploitation of RCE Vulnerability CVE-2025-33053
id: abe06362-a5b9-4371-8724-ebd00cd48a04
related:
    - id: 9a2d8b3e-f5a1-4c68-9e21-7d9e1cf8a123
      type: similar
    - id: 04fc4b22-91a6-495a-879d-0144fec5ec03
      type: similar
status: experimental
description: |
    Detects potential exploitation of remote code execution vulnerability CVE-2025-33053
    which involves unauthorized code execution via WebDAV through external control of file names or paths.
    The exploit abuses legitimate utilities like iediagcmd.exe or CustomShellHost.exe  by manipulating
    their working directories to point to attacker-controlled WebDAV servers, causing them to execute
    malicious executables (like route.exe) from the WebDAV path instead of legitimate system binaries
    through Process.Start() search order manipulation.
references:
    - https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053
    - https://research.checkpoint.com/2025/stealth-falcon-zero-day/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-06-13
tags:
    - attack.command-and-control
    - attack.execution
    - attack.stealth
    - attack.t1218
    - attack.lateral-movement
    - attack.t1105
    - detection.emerging-threats
    - cve.2025-33053
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage:
            - 'C:\Program Files\internet explorer\iediagcmd.exe'
            - 'C:\Windows\System32\CustomShellHost.exe'
    selection_child_current_dir:
        - CurrentDirectory|startswith: '\\\\'
        - CurrentDirectory|contains: '\DavWWWRoot\'
        - Image|contains: '\DavWWWRoot\'
        - Image|startswith: '\\\\'
    selection_child_img:
        Image|endswith:
            - '\route.exe'
            - '\netsh.exe'
            - '\makecab.exe'
            - '\dxdiag.exe'
            - '\ipconfig.exe'
            - '\explorer.exe'
    filter_main_system:
        Image|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
    condition: all of selection_* and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_* and not 1 of filter_main_*

Stage 1: `selection_parent`

selection_parent:
    ParentImage:
        - 'C:\Program Files\internet explorer\iediagcmd.exe'
        - 'C:\Windows\System32\CustomShellHost.exe'

Stage 2: `selection_child_current_dir`

selection_child_current_dir:
    - CurrentDirectory|startswith: '\\\\'
    - CurrentDirectory|contains: '\DavWWWRoot\'
    - Image|contains: '\DavWWWRoot\'
    - Image|startswith: '\\\\'

Stage 3: `selection_child_img`

selection_child_img:
    Image|endswith:
        - '\route.exe'
        - '\netsh.exe'
        - '\makecab.exe'
        - '\dxdiag.exe'
        - '\ipconfig.exe'
        - '\explorer.exe'

Stage 4: `not filter_main_system`

filter_main_system:
    Image|startswith:
        - 'C:\Windows\System32\'
        - 'C:\Windows\SysWOW64\'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	starts_with	`C:\Windows\SysWOW64\`	`excludes:Image` `field:"Image" value:"C:\Windows\SysWOW64\"`
`Image`	starts_with	`C:\Windows\System32\`	`excludes:Image` `field:"Image" value:"C:\Windows\System32\"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CurrentDirectory`	match	`\DavWWWRoot\`	`field:"CurrentDirectory" kind:match value:"\DavWWWRoot\"`
`CurrentDirectory`	starts_with	`\\\\`	`field:"CurrentDirectory" kind:starts_with value:"\\\\"`
`Image`	ends_with	`\dxdiag.exe` corpus 2 (sigma 2) `\explorer.exe` corpus 13 (sigma 13) `\ipconfig.exe` corpus 5 (sigma 5) `\makecab.exe` corpus 4 (sigma 4) `\netsh.exe` corpus 28 (sigma 28) `\route.exe` corpus 3 (sigma 3)	`field:"Image" kind:ends_with`
`Image`	match	`\DavWWWRoot\` corpus 3 (sigma 3)	`field:"Image" kind:match value:"\DavWWWRoot\"`
`Image`	starts_with	`\\\\` corpus 4 (sigma 4)	`field:"Image" kind:starts_with value:"\\\\"`
`ParentImage`	eq	`C:\Program Files\internet explorer\iediagcmd.exe` corpus 3 (elastic 2, sigma 1) `C:\Windows\System32\CustomShellHost.exe`	`field:"ParentImage" kind:eq`