Query: Sigma rule for Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie.
Matching passage: Sigma rule: Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie.. Logsource: windows / process_creation. Rule: title: Suspicious WebDav Client Execution Via Rundll32.EXE id: 982e9f2d-1a85-4d5b-aea4-31f5e97c6555 status: test description: 'Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server) or potentially a sign of exploitation of CVE-2023-23397 ' references: - https://twitter.com/aceresponder/status/1636116096506818562 - https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/ - https://www.pwndefend.com/2023/03/15/the-long-game-persistent-hash-theft/ - https://www.microsoft.com/en-us/security/blog/wp-content/uploads/2023/03/Figure-7-sample-webdav-process-create-event.png - https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/ author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) date: 2023-03-16 modified: 2023-09-18 tags: - attack.exfiltration - attack.t1048.003 - cve.2023-23397 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \svchost.exe ParentCommandLine|contains: -s WebClient Image|endswith: \rundll32.exe CommandLine|contains: C:\windows\system32\davclnt.dll,DavSetCookie CommandLine|re: ://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} filter_local_ips: CommandLine|contains: - ://10. - ://192.168. - ://172.16. - ://172.17. - ://172.18. - ://172.19. - ://172.20. - ://172.21. - ://172.22. - ://172.23. - ://172.24. - ://172.25. - ://172.26. - ://172.27. - ://172.28. - ://172.29. - ://172.30. - ://172.31. - ://127. - ://169.254. condition: selection and not 1 of filter_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects possible Java payloads in web access logs. Logsource: webserver. Rule: title: Java Payload Strings id: 583aa0a2-30b1-4d62-8bf3-ab73689efe6c status: test description: Detects possible Java payloads in web access logs references: - https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/ - https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/ - https://github.com/httpvoid/writeups/blob/62d3751945289d088ccfdf4d0ffbf61598a2cd7d/Confluence-RCE.md - https://twitter.com/httpvoid0x2f/status/1532924261035384832 - https://medium.com/geekculture/text4shell-exploit-walkthrough-ebc02a01f035 author: frack113, Harjot Singh, "@cyb3rjy0t" (update) date: 2022-06-04 modified: 2023-01-19 tags: - cve.2022-26134 - cve.2021-26084 - attack.initial-access - attack.t1190 logsource: category: webserver detection: keywords: - '%24%7B%28%23a%3D%40' - ${(#a=@ - '%24%7B%40java' - ${@java - u0022java - '%2F%24%7B%23' - /${# - new+java. - getRuntime().exec( - getRuntime%28%29.exec%28 condition: keywords falsepositives: - Legitimate apps level: high