Detection rules › Splunk
WebDAV LNK Execution (Windows Event Log)
Threat actors often place malicious payloads on remote servers, which are then downloaded and executed on the user’s PC using scripts or other methods. One type of server attackers can leverage is WebDAV (Web Distributed Authoring and Versioning) — a file transfer protocol built on top of HTTP. Threat actors can exploit this technique by creating LNK files that, when accessed through Windows Explorer, execute commands or scripts, enabling remote code execution and further malicious activities. This use case detects when a LNK file was possibly executed from a WebDAV server by a user who might have been tricked into accessing a URL shortcut.
MITRE ATT&CK coverage
References
- https://www.trellix.com/blogs/research/beyond-file-search-a-novel-method/
- https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_webdav_lnk_execution.yml
- https://attack.mitre.org/techniques/T1059/001/
- https://attack.mitre.org/techniques/T1059/003/
- https://attack.mitre.org/techniques/T1204/
- https://any.run/cybersecurity-blog/client-side-exploitation/
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '35597.62475'
title: WebDAV LNK Execution
description: Threat actors often place malicious payloads on remote servers, which
are then downloaded and executed on the user’s PC using scripts or other methods.
One type of server attackers can leverage is WebDAV (Web Distributed Authoring and
Versioning) — a file transfer protocol built on top of HTTP. Threat actors can exploit
this technique by creating LNK files that, when accessed through Windows Explorer,
execute commands or scripts, enabling remote code execution and further malicious
activities. This use case detects when a LNK file was possibly executed from a WebDAV
server by a user who might have been tricked into accessing a URL shortcut.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) "explorer.exe" ("cmd.exe" OR "cscript.exe" OR
"mshta.exe" OR "powershell.exe" OR "pwsh.exe" OR "wscript.exe") TERM(DavWWWRoot)
| regex parent_process_name="(?i)explorer\.exe" | regex process_name="(?i)(cmd|(c|w)script|mshta|powershell|pwsh)\.exe"|
regex process="(?i)DavWWWRoot" | table _time, host, user, parent_*, process, process_*
| bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter:powershell
- execution:user execution
- execution:command and scripting interpreter:windows command shell
technique_id:
- T1059.001
- T1204
- T1059.003
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://www.trellix.com/blogs/research/beyond-file-search-a-novel-method/
- https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_webdav_lnk_execution.yml
- https://attack.mitre.org/techniques/T1059/001/
- https://attack.mitre.org/techniques/T1059/003/
- https://attack.mitre.org/techniques/T1204/
- https://any.run/cybersecurity-blog/client-side-exploitation/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) "explorer.exe" ("cmd.exe" OR "cscript.exe" OR "mshta.exe" OR "powershell.exe" OR "pwsh.exe" OR "wscript.exe") TERM(DavWWWRoot)
Stage 2: regex
| regex parent_process_name="(?i)explorer\.exe"
Stage 3: regex
| regex process_name="(?i)(cmd|(c|w)script|mshta|powershell|pwsh)\.exe"
Stage 4: regex
| regex process="(?i)DavWWWRoot"
Stage 5: table
| table _time, host, user, parent_*, process, process_*
Stage 6: bucket
| bin span=1s
Stage 7: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
parent_process_name | regex_match |
|
process | regex_match |
|
process_name | regex_match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | "explorer.exe" |
| 1 | "cmd.exe" |
| 1 | "cscript.exe" |
| 1 | "mshta.exe" |
| 1 | "powershell.exe" |
| 1 | "pwsh.exe" |
| 1 | "wscript.exe" |
| 1 | TERM |
| 1 | DavWWWRoot |