Abusing the “search-ms” URI protocol handler

What it is

A DFIR.ch walkthrough of a live sample of the "search-ms" URI phishing chain first documented by Trustwave (whose copy of the payload server was already offline). The author recovered a still-live sample from VirusTotal and reconstructs the full chain — the delivered file is an HTML attachment ("Booking_Confirmation.html") that auto-triggers a fake Windows Search result over WebDAV, serving an LNK ("e_Statement00844301.lnk") that runs conhost.exe --headless against a batch script hosted on a trycloudflare.com tunnel.

How it works

Opening the HTML alone triggers the pop-up — no link click is needed. The search-ms handler searches a remote WebDAV server for the term e_Statement, and a spoofable displayname parameter (set to "Downloads") disguises the result window. WebDAV runs over HTTP, initiated via svchost.exe -k LocalService -p -s WebClient spawning rundll32.exe ... davclnt.dll,DavSetCookie. The LNK then chains conhost --headless → cmd /c \\...@SSL\DavWWWRoot\new.bat.

What to do — detections

The value here is the concrete forensic/hunting artifacts, most of which the summary only gestures at:

• Hunt for the WebDAV client initiation, a strong signal since it precedes the whole chain:

rundll32.exe C:\Windows\system32\davclnt.dll,DavSetCookie <host>@SSL https://<host>/

• Hunt for conhost.exe --headless invoking a UNC/WebDAV path (\\...@SSL\DavWWWRoot\...).
• Deobfuscate the new.bat/startuppp.bat batch obfuscation by prefixing each line with an echo (technique credited to OneConsult) to render readable code.
• Payload indicators (this sample): C2 float-suppose-msg-pulling.trycloudflare.com; decoy kyvbsa.pdf; DXJS.zip; staged startuppp.bat. The batch uses timeout /t 5 to let the decoy PDF open before the infection routine runs.

Caveats

• Blocking SMB (445/TCP) does not stop this — WebDAV uses HTTP, so egress SMB filtering is ineffective; the author cites Trellix on this point.
• IOCs are tied to one recovered sample; the Cloudflare tunnel domain is disposable and will differ across campaigns. The behavioral signatures (davclnt.dll DavSetCookie, conhost --headless over WebDAV) are the durable detections.

flowchart TD
    A[Open HTML attachment] -->|auto pop-up| B{Open Explorer?}
    B -->|cancel| Z[chain stops]
    B -->|open| C[WebDAV over HTTP<br/>davclnt.dll DavSetCookie]
    C --> D[Fake search result: LNK]
    D -->|security warning, user consents| E[conhost --headless new.bat]
    E --> F[decoy PDF]
    E --> G[DXJS.zip + startuppp.bat]