WebDAV Working-Directory Executable Launch (CVE-2025-33053 / MoTW Bypass)

Duo Tech@duotech

•updated Jul 21, 2026•1•0•4

Detects process creation consistent with CVE-2025-33053 exploitation, where a crafted Internet Shortcut (.url) file sets its target to iediagcmd.exe with a WorkingDirectory pointing to a WebDAV DavWWWRoot UNC path, causing iediagcmd.exe to resolve and launch LOLBins (route.exe, ipconfig.exe, netsh.exe, ping.exe) from the attacker-controlled WebDAV share instead of the legitimate System32 directory.