WebDAV Malware-Delivery Lab — search-ms → WebDAV → PureRAT 4.4.3

Looks for: any process whose image path or command line resolves to a WebDAV UNC (\\host@80\ or \\host@ssl@443\DavWWWRoot\). This is the core, IOC-independent detection for the whole delivery class.

// HUNT: Process image/command line references a WebDAV UNC path
// MITRE: T1204.002 | CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/@(80|ssl@443)\\/i OR ImageFileName=/@(80|ssl@443)\\/i OR CommandLine=/DavWWWRoot/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine])
| sort(@timestamp, order=desc, limit=500)

Looks for: the WebClient (WebDAV) service being launched via svchost.exe -s WebClient, or rundll32.exe loading davclnt.dll. On hosts with no legitimate WebDAV use, WebClient starting is a strong delivery precursor. FP: environments that use SharePoint/WebDAV "Open in Explorer" legitimately — baseline those hosts and exclude them.

// HUNT: WebClient (WebDAV) service init / davclnt.dll load
// MITRE: T1071 | CONF: high  FP: medium  COST: low | REQUIRES: ProcessRollup2
// TUNING: exclude hosts/OUs that use SharePoint "Open in Explorer" or map WebDAV drives by policy
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| (FileName=/^svchost\.exe$/i AND CommandLine=/-s\s+WebClient/i) OR CommandLine=/davclnt\.dll/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=500)

Looks for: an explorer.exe command line carrying a search-ms: URI that references a UNC location or a *.scr query — the exact handoff the phishing page performs. FP: legitimate saved-search files are local; a search-ms: containing a UNC location: crumb is anomalous.

// HUNT: search-ms URI pointing at a remote/UNC location
// MITRE: T1204.002 | CONF: high  FP: medium  COST: low | REQUIRES: ProcessRollup2
// TUNING: legit saved searches are local-only; require a UNC crumb or *.scr query to cut noise
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/search-ms:/i
| CommandLine=/(location:\\\\|query=\*\.scr|crumb=location)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=500)

Looks for: a signed diagnostics/LOLBin (iediagcmd.exe, CustomShellHost.exe) spawning route.exe/ipconfig.exe/netsh.exe/ping.exe — the child-by-name behavior CVE-2025-33053 abuses to run an attacker binary from a WebDAV working directory. FP: legitimate diagnostics genuinely spawn these; pair with Q1 or check the child's working directory for a UNC path.

// HUNT: iediagcmd/CustomShellHost spawning route/ipconfig/netsh/ping (working-dir hijack)
// MITRE: T1203,T1574 | CONF: high  FP: medium  COST: low | REQUIRES: ProcessRollup2
// TUNING: benign IE diagnostics also spawn these; correlate with Q1 (UNC image) or a WebDAV parent
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| in(ParentBaseFileName, values=["iediagcmd.exe","customshellhost.exe"], ignoreCase=true)
| in(FileName, values=["route.exe","ipconfig.exe","netsh.exe","ping.exe"], ignoreCase=true)
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=500)

Looks for: a command line where .pdf (or another doc extension) is followed by an executable extension (.scr/.exe/.cmd) — the double-extension / RTLO masquerade — or an Inno Setup SFX unpacking to %TEMP%\is-*.tmp\. FP: archive tools and installers legitimately use is-*.tmp; the double-extension token is the higher-fidelity half.

// HUNT: doc-then-exe double extension, or Inno Setup SFX staging in %TEMP%\is-*.tmp
// MITRE: T1036.002,T1036.007 | CONF: medium  FP: medium  COST: medium | REQUIRES: ProcessRollup2
// TUNING: exclude known-good installer vendors writing is-*.tmp; the .pdf.(scr|exe) token is the strong signal
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/\.(pdf|doc|docx|xls|jpg)\s*\.(scr|exe|cmd|com|pif)/i OR CommandLine=/\\is-[a-z0-9]+\.tmp\\/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=500)

Looks for: the named sideload artifacts (Volt_Droid.exe, discord-rpc.x64.dll, profiler16.dll, loader-pool.db) or a COR_PROFILER environment reference on the command line. FP: legitimate Discord RPC integrations reference discord-rpc; combine with the temp/AppData staging path or Volt_Droid parent.

// HUNT: DlrtyGames sideload artifacts / COR_PROFILER hijack reference
// MITRE: T1574.001,T1574.012 | CONF: medium  FP: medium  COST: low | REQUIRES: ProcessRollup2
// TUNING: genuine Discord RPC uses discord-rpc; require Volt_Droid parent or a temp/AppData path to confirm
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/(volt_droid|discord-rpc\.x64|profiler16\.dll|loader-pool\.db|COR_PROFILER)/i OR FileName=/^volt_droid\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=500)

Looks for: creation of the campaign's named scheduled tasks (brokerhost, net_queue_32) or the distinctive Run-key value XNNNMHJAZNCNHGIKJDW. High-fidelity retro-hunt indicators.

// HUNT: named scheduled tasks + Run key persistence
// MITRE: T1053.005,T1547.001 | CONF: high  FP: low  COST: low | REQUIRES: ScheduledTaskRegistered, AsepValueUpdate
#event_simpleName=/ScheduledTaskRegistered|AsepValueUpdate/
| TaskName=/(brokerhost|net_queue_32)/i OR ScheduledTaskName=/(brokerhost|net_queue_32)/i OR RegValueName=/XNNNMHJAZNCNHGIKJDW/i OR RegObjectName=/(com_app_bg_i686|messenger_component_v8_32_rc)/i
| table([@timestamp, ComputerName, UserName, TaskName, ScheduledTaskName, RegObjectName, RegValueName])
| sort(@timestamp, order=desc, limit=500)

Looks for: outbound connections to the two campaign C2 IPs, or to the distinctive high ports the stealer used (56001-56003, 57666, 57777, 57888). FP: the odd-port list alone is broad — treat a port-only hit as a pivot, and a C2-IP hit as detect. IPs are perishable; refresh from current intel.

// HUNT: egress to campaign C2 IPs or distinctive high ports
// MITRE: T1571,T1041 | CONF: medium  FP: medium  COST: low | REQUIRES: NetworkConnectIP4
// TUNING: IP hits = detect; bare high-port hits = pivot only. Validate IPs are still live before alerting.
#event_simpleName=/NetworkConnectIP4/
| in(RemoteAddressIP4, values=["77.110.127.205","23.94.252.228","138.124.123.87"])
   OR in(RemotePort, values=["56001","56002","56003","57666","57777","57888"])
| table([@timestamp, ComputerName, FileName, RemoteAddressIP4, RemotePort])
| sort(@timestamp, order=desc, limit=500)

Looks for: execution of any of the six named-payload SHA-256 hashes across the two chains. Exact-match retro-hunt; low FP by construction.

// HUNT: campaign payload SHA-256 execution
// MITRE: T1204.002 | CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| in(SHA256HashData, values=[
    "04a8018191f2e9e76072d072a933371d9d669a42de2b2a087541cd3a653b0ba7",
    "e8be17a7fbef48b45f1e958b3ae5ebdfcad58808969982c431a905eefcae5268",
    "449d1121fa275879af22a20407aa7253ac750ac8fa7ff5691101752600d645df",
    "a88f5ee748e60f889d046718bfe3ddcf1c5f3cba2001cad587e8953a76bf7aa9",
    "51a02eccdcae0483c7cbb9796738eee6c2a13b740d30e5417cda09bf418ea93b",
    "82e67735cf822db8f2f759e742e5bf8c54fdbd01a4170619b9e0916e1b3f5923"], ignoreCase=true)
| table([@timestamp, ComputerName, UserName, FileName, SHA256HashData])
| sort(@timestamp, order=desc, limit=500)