Windows search: protocol URI with WebDAV crumb and DisplayName spoofing
Detects the execution of search-ms or search protocol URIs that contain a 'crumb' parameter combined with either a 'displayname' parameter or remote path indicators (such as WebDAV/UNC paths). This technique is commonly used by adversaries to redirect Windows Search to a remote, malicious location while masking the source by spoofing the displayed name or path to trick users.
Sigma
