Bypass Record
Exploitation for Priv-Esc × Microsoft Windows (WebDAV component)
A publicly-reported instance of Exploitation for Priv-Esc bypassing Microsoft Windows (WebDAV component), recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
A malicious .url file points to iediagcmd.exe but sets the working directory to an attacker-controlled WebDAV server. Due to .NET Process.Start() search order, the legitimate tool loads and executes a malicious route.exe from the remote server via process hollowing, bypassing signature-based defenses.
Detection & mitigation
Monitor for unexpected network connections from diagnostic tools like iediagcmd.exe, especially to external WebDAV servers (port 80/443 with WebDAV methods). Deploy attack surface reduction rules to block executable content from WebDAV and restrict .url file handling from untrusted sources.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.