Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Suspicious File Execution From Internet Hosted WebDav Share

Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content in it. As seen being used in malicious LNK files

ATT&CK coverage

Outside the enterprise matrix

T1059.001

Detection requirements

Log source product: windows
Log source category: process_creation

What the source says

What fires this without an attack behind it

Unknown

References

https://twitter.com/ShadowChasing1/status/1552595370961944576
https://www.virustotal.com/gui/file/a63376ee1dba76361df73338928e528ca5b20171ea74c24581605366dcaa0104/behavior

Tagged by the source as

attack.execution

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.