Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access

SIGMA detection rule by Swachchhanda Shrawan Poudel (Nextron Systems) · NOASSERTION

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 by looking for process access that involves legitimate Windows executables (iediagcmd.exe, CustomShellHost.exe) accessing suspicious executables hosted on WebDAV shares. This indicates an attacker may be exploiting Process.Start() search order manipulation to execute malicious code from attacker-controlled WebDAV servers instead of legitimate system binaries. The vulnerability allows unauthorized code execution through external control of file names or paths via WebDAV.

title: Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access
id: 9a2d8b3e-f5a1-4c68-9e21-7d9e1cf8a123
related:
    - id: abe06362-a5b9-4371-8724-ebd00cd48a04
      type: similar
    - id: 04fc4b22-91a6-495a-879d-0144fec5ec03
      type: similar
status: experimental
description: |
    Detects potential exploitation of remote code execution vulnerability CVE-2025-33053
    by looking for process access that involves legitimate Windows executables (iediagcmd.exe, CustomShellHost.exe)
    accessing suspicious executables hosted on WebDAV shares. This indicates an attacker may be exploiting
    Process.Start() search order manipulation to execute malicious code from attacker-controlled WebDAV servers
    instead of legitimate system binaries. The vulnerability allows unauthorized code execution through
    external control of file names or paths via WebDAV.
references:
    - https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053
    - https://research.checkpoint.com/2025/stealth-falcon-zero-day/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-06-13
tags:
    - attack.command-and-control
    - attack.execution
    - attack.stealth
    - attack.t1218
    - attack.lateral-movement
    - attack.t1105
    - detection.emerging-threats
    - cve.2025-33053
logsource:
    category: process_access
    product: windows
detection:
    selection_src:
        SourceImage:
            - 'C:\Program Files\internet explorer\iediagcmd.exe'
            - 'C:\Windows\System32\CustomShellHost.exe'
    selection_target_dir:
        - TargetImage|startswith: '\\\\'
        - TargetImage|contains: '\DavWWWRoot\'
    selection_target_exe:
        TargetImage|endswith:
            - '\route.exe'
            - '\netsh.exe'
            - '\makecab.exe'
            - '\dxdiag.exe'
            - '\ipconfig.exe'
            - '\explorer.exe'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

1cf0b95e-5987-4da6-946b-c78c905b43ec

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion