Attempt to Mount a Remote WebDav Share

[rule]
description = """
Identifies attempt to mount or copy files from a remote WebDav Share. Adversaries may abuse this method to evade
dropping malicious files to victim file system.
"""
id = "0a364281-5edc-4f75-a839-48b150cec3f2"
license = "Elastic License v2"
name = "Attempt to Mount a Remote WebDav Share"
os_list = ["windows"]
version = "1.0.10"

query = '''
process where event.action == "start" and
 (
  (process.name : "explorer.exe" and process.args : "\\\\*@*") or
  (process.name : "rundll32.exe" and process.command_line : "*\\\\*@*,*" and process.parent.name : ("explorer.exe", "cmd.exe", "powershell.exe", "mshta.exe", "msiexec.exe")) or 
  (process.name : "net.exe" and process.args : "use" and 
   ((process.args : ("http*:*", "*webdav*") and process.args : "/user*@*") or process.command_line : "*\\\\*@ssl\\*") and not process.command_line : "*//localhost*") or
  (process.name : ("expand.exe", "xcopy.exe", "cmd.exe") and process.args : ("\\\\webdav*", "*DavWWWRoot*"))
 ) and
 not (process.parent.name : "rundll32.exe" and process.parent.args : "?:\\Program Files\\Microsoft Office\\root\\Office16\\MLCFG32.CPL") and
 not process.parent.executable : ("C:\\Program Files\\Microsoft Office\\root\\Office16\\WINPROJ.EXE",
                                  "D:\\SF-Deploy\\Console\\Console.exe",
                                  "C:\\Program Files\\WindowsApps\\MyCaseInc.MyCaseFileSync_*\\app\\MyCase Desktop.exe",
                                  "C:\\Program Files\\Microsoft Office\\root\\Office16\\OUTLOOK.EXE") and
 not (process.name : "xcopy.exe" and process.args : "\\\\*.sharepoint.com\\DavWWWRoot\\sites\\*")
'''

min_endpoint_version = "7.16.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"
[[threat.technique.subtechnique]]
id = "T1021.002"
name = "SMB/Windows Admin Shares"
reference = "https://attack.mitre.org/techniques/T1021/002/"



[threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[internal]
min_endpoint_version = "7.16.0"