Rare Connection to WebDAV Target for Credential Access

Attackers can leverage the WebDAV protocol to capture user credentials through forced authentication. By embedding a WebDAV path within a document or application, they can trick a user's system into sending NTLM credentials to a server controlled by the attacker. The rundll32.exe process, a legitimate Windows utility, can be abused to initiate these WebDAV connections using the DavSetCookie function. This detection focuses on identifying rare or unusual connections to WebDAV servers, filtering out known legitimate services and internal network ranges, to highlight potential credential theft attempts. The rule looks for rundll32.exe executions where the command line contains "DavSetCookie" and the destination server is not in a pre-defined list of known-good domains.

Attack Chain

1. An attacker crafts a malicious document (e.g., Word, Excel) or modifies an application configuration.
2. The malicious document/application contains a link or reference to a WebDAV server controlled by the attacker, using a UNC path or URL.
3. A victim user opens the malicious document or application.
4. The operating system attempts to resolve the WebDAV path using the SMB protocol for UNC paths or HTTP/HTTPS for URLs.
5. The rundll32.exe process is invoked with the DavSetCookie parameter, initiating a connection to the attacker's WebDAV server.
6. The victim's system attempts to authenticate to the WebDAV server, potentially sending NTLM credentials.
7. The attacker captures the NTLM hash.
8. The attacker may attempt to crack the NTLM hash or relay it to other systems to gain unauthorized access.

Impact

Successful exploitation can lead to the theft of user credentials, allowing attackers to gain unauthorized access to sensitive data and systems. While the rule focuses on detecting the initial WebDAV connection, the subsequent compromise of credentials can have wide-ranging consequences, including lateral movement, data exfiltration, and further system compromise. The severity is medium because it identifies a potential credential access attempt, but further investigation is needed to confirm actual credential compromise.

Recommendation

• Deploy the Sigma rule Detect Rare WebDAV Destination via Rundll32 to your SIEM to identify potential WebDAV credential theft attempts.
• Enable process creation logging, specifically monitoring for rundll32.exe, to ensure the Sigma rule can function correctly (reference log source).
• Investigate any alerts generated by the Sigma rule, focusing on the destination domain and the user account involved.
• Implement network segmentation and restrict outbound SMB traffic to prevent credential relay attacks (reference TTPs).
• Monitor user activity for suspicious network connections following a WebDAV alert (reference TTPs).