Sigma rule: Potential Exploitation of RCE Vulnerability CVE-2025-33053

Rule

Title

Potential Exploitation of RCE Vulnerability CVE-2025-33053

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-06-13

File

rules-emerging-threats/2025/Exploits/CVE-2025-33053/proc_creation_win_exploit_cve_2025_33053.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053
which involves unauthorized code execution via WebDAV through external control of file names or paths.
The exploit abuses legitimate utilities like iediagcmd.exe or CustomShellHost.exe by manipulating
their working directories to point to attacker-controlled WebDAV servers, causing them to execute
malicious executables (like route.exe) from the WebDAV path instead of legitimate system binaries
through Process.Start() search order manipulation.

Log source

product

windows

category

process_creation

Detection

selection_parent:
    ParentImage:
        - 'C:\Program Files\internet explorer\iediagcmd.exe'
        - 'C:\Windows\System32\CustomShellHost.exe'
selection_child_current_dir:
    - CurrentDirectory|startswith: '\\\\'
    - CurrentDirectory|contains: '\DavWWWRoot\'
    - Image|contains: '\DavWWWRoot\'
    - Image|startswith: '\\\\'
selection_child_img:
    Image|endswith:
        - '\route.exe'
        - '\netsh.exe'
        - '\makecab.exe'
        - '\dxdiag.exe'
        - '\ipconfig.exe'
        - '\explorer.exe'
filter_main_system:
    Image|startswith:
        - 'C:\Windows\System32\'
        - 'C:\Windows\SysWOW64\'
condition: all of selection_* and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.command-and-control
• attack.execution
• attack.stealth
• attack.t1218
• attack.lateral-movement
• attack.t1105
• detection.emerging-threats
• cve.2025-33053

CVEs this rule names

• CVE-2025-33053

MITRE ATT&CK ids this rule names

• T1105
• T1218

Related rules

• 9a2d8b3e-f5a1-4c68-9e21-7d9e1cf8a123 (similar)
• 04fc4b22-91a6-495a-879d-0144fec5ec03 (similar)

References

• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053
• https://research.checkpoint.com/2025/stealth-falcon-zero-day/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2025/Exploits/CVE-2025-33053/proc_creation_win_exploit_cve_2025_33053.yml