Sigma rule: Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load

Rule

Title

Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-06-13

File

rules-emerging-threats/2025/Exploits/CVE-2025-33053/image_load_win_exploit_cve_2025_33053.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053
by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from
attacker-controlled WebDAV servers loading the Windows system DLLs like gdi32.dll, netapi32.dll, etc.

Log source

product

windows

category

image_load

Detection

selection_img_path:
    Image|startswith: '\\\\'
    Image|contains: '\DavWWWRoot\'
selection_img_bin:
    Image|endswith:
        - '\route.exe'
        - '\netsh.exe'
        - '\makecab.exe'
        - '\dxdiag.exe'
        - '\ipconfig.exe'
        - '\explorer.exe'
condition: all of selection_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.command-and-control
• attack.execution
• attack.stealth
• attack.t1218
• attack.lateral-movement
• attack.t1105
• detection.emerging-threats
• cve.2025-33053

CVEs this rule names

• CVE-2025-33053

MITRE ATT&CK ids this rule names

• T1105
• T1218

Related rules

• abe06362-a5b9-4371-8724-ebd00cd48a04 (similar)
• 9a2d8b3e-f5a1-4c68-9e21-7d9e1cf8a123 (similar)

References

• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053
• https://research.checkpoint.com/2025/stealth-falcon-zero-day/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2025/Exploits/CVE-2025-33053/image_load_win_exploit_cve_2025_33053.yml