Suspicious External WebDAV Execution

Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.

Sigma rule (View on GitHub)

 1title: Suspicious External WebDAV Execution
 2id: 1ae64f96-72b6-48b3-ad3d-e71dff6c6398
 3related:
 4    - id: 4c55738d-72d8-490e-a2db-7969654e375f
 5      type: similar
 6status: experimental
 7description: |
 8        Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.
 9references:
10    - https://dear-territory-023.notion.site/WebDav-Share-Testing-e4950fa0c00149c3aa430d779b9b1d0f?pvs=4
11    - https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462
12    - https://www.trendmicro.com/en_no/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html
13    - https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html
14author: Ahmed Farouk
15date: 2024-05-10
16tags:
17    - attack.initial-access
18    - attack.t1584
19    - attack.t1566
20logsource:
21    category: proxy
22detection:
23    selection_webdav:
24        c-useragent|startswith: 'Microsoft-WebDAV-MiniRedir/'
25        cs-method: 'GET'
26    selection_execution:
27        c-uri|endswith:
28            - '.7z'
29            - '.bat'
30            - '.dat'
31            - '.cmd'
32            - '.exe'
33            - '.js'
34            - '.lnk'
35            - '.ps1'
36            - '.rar'
37            - '.url'
38            - '.vbe'
39            - '.vbs'
40            - '.zip'
41    filter_main_local_ips:
42        dst_ip|cidr:
43            - '127.0.0.0/8'
44            - '10.0.0.0/8'
45            - '172.16.0.0/12'
46            - '192.168.0.0/16'
47            - '169.254.0.0/16'
48            - '::1/128'  # IPv6 loopback
49            - 'fe80::/10'  # IPv6 link-local addresses
50            - 'fc00::/7'  # IPv6 private addresses
51    condition: all of selection_* and not 1 of filter_main_*
52falsepositives:
53    - Unknown
54level: high

References

Related rules

to-top