Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 by looking for process access that involves legitimate Windows executables (iediagcmd.exe, CustomShellHost.exe) accessing suspicious executables hosted on WebDAV shares. This indicates an attacker may be exploiting Process.Start() search order manipulation to execute malicious code from attacker-controlled WebDAV servers instead of legitimate system binaries. The vulnerability allows unauthorized code execution through external control of file names or paths via WebDAV.

2025-06-13 00:00:00

None

9a2d8b3e-f5a1-4c68-9e21-7d9e1cf8a123

attack.execution attack.defense-evasion attack.t1218 attack.lateral-movement attack.t1105 detection.emerging-threats cve.2025-33053

Community Rule

Swachchhanda Shrawan Poudel

Merge PR #5479 from @swachchhanda000 - Webdav CVE-2025-33053 RCE vulnerability

2025-06-13