Suspicious External WebDAV Execution
Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.
Sigma rule (View on GitHub)
1title: Suspicious External WebDAV Execution
2id: 1ae64f96-72b6-48b3-ad3d-e71dff6c6398
3related:
4 - id: 4c55738d-72d8-490e-a2db-7969654e375f
5 type: similar
6status: experimental
7description: |
8 Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.
9references:
10 - https://dear-territory-023.notion.site/WebDav-Share-Testing-e4950fa0c00149c3aa430d779b9b1d0f?pvs=4
11 - https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462
12 - https://www.trendmicro.com/en_no/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html
13 - https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html
14author: Ahmed Farouk
15date: 2024-05-10
16tags:
17 - attack.initial-access
18 - attack.t1584
19 - attack.t1566
20logsource:
21 category: proxy
22detection:
23 selection_webdav:
24 c-useragent|startswith: 'Microsoft-WebDAV-MiniRedir/'
25 cs-method: 'GET'
26 selection_execution:
27 c-uri|endswith:
28 - '.7z'
29 - '.bat'
30 - '.dat'
31 - '.cmd'
32 - '.exe'
33 - '.js'
34 - '.lnk'
35 - '.ps1'
36 - '.rar'
37 - '.url'
38 - '.vbe'
39 - '.vbs'
40 - '.zip'
41 filter_main_local_ips:
42 dst_ip|cidr:
43 - '127.0.0.0/8'
44 - '10.0.0.0/8'
45 - '172.16.0.0/12'
46 - '192.168.0.0/16'
47 - '169.254.0.0/16'
48 - '::1/128' # IPv6 loopback
49 - 'fe80::/10' # IPv6 link-local addresses
50 - 'fc00::/7' # IPv6 private addresses
51 condition: all of selection_* and not 1 of filter_main_*
52falsepositives:
53 - Unknown
54level: high
References
-
A new tool that blends your everyday work apps into one. It's the all-in-one workspace for you and your team
Read More -
-
The APT group Water Hydra has been exploiting the Microsoft Defender SmartScreen vulnerability CVE-2024-21412 in its campaigns targeting financial market traders. This vulnerability, which has now been patched by Microsoft, was discovered and disclosed by the Trend Micro Zero Day Initiative.
Read More
Related rules
- Download From Suspicious TLD - Blacklist
- Download From Suspicious TLD - Whitelist
- HTML Help HH.EXE Suspicious Child Process
- Okta FastPass Phishing Detection
- Phishing Pattern ISO in Archive