Suspicious External WebDAV Execution
Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.
Sigma rule (View on GitHub)
1title: Suspicious External WebDAV Execution
2id: 1ae64f96-72b6-48b3-ad3d-e71dff6c6398
3related:
4 - id: 4c55738d-72d8-490e-a2db-7969654e375f
5 type: similar
6status: experimental
7description: |
8 Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.
9references:
10 - https://dear-territory-023.notion.site/WebDav-Share-Testing-e4950fa0c00149c3aa430d779b9b1d0f?pvs=4
11 - https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462
12 - https://www.trendmicro.com/en_no/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html
13 - https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html
14author: Ahmed Farouk
15date: 2024/05/10
16tags:
17 - attack.initial_access
18 - attack.t1584
19 - attack.t1566
20logsource:
21 category: proxy
22detection:
23 selection_webdav:
24 c-useragent|startswith: 'Microsoft-WebDAV-MiniRedir/'
25 cs-method: 'GET'
26 selection_execution:
27 c-uri|endswith:
28 - '.7z'
29 - '.bat'
30 - '.dat'
31 - '.cmd'
32 - '.exe'
33 - '.js'
34 - '.lnk'
35 - '.ps1'
36 - '.rar'
37 - '.url'
38 - '.vbe'
39 - '.vbs'
40 - '.zip'
41 filter_main_local_ips:
42 dst_ip|cidr:
43 - '127.0.0.0/8'
44 - '10.0.0.0/8'
45 - '172.16.0.0/12'
46 - '192.168.0.0/16'
47 - '169.254.0.0/16'
48 - '::1/128' # IPv6 loopback
49 - 'fe80::/10' # IPv6 link-local addresses
50 - 'fc00::/7' # IPv6 private addresses
51 condition: all of selection_* and not 1 of filter_main_*
52falsepositives:
53 - Unknown
54level: high
References
-
A new tool that blends your everyday work apps into one. It's the all-in-one workspace for you and your team
Read More -
-
The APT group Water Hydra has been exploiting the Microsoft Defender SmartScreen vulnerability CVE-2024-21412 in its campaigns targeting financial market traders. This vulnerability, which has now been patched by Microsoft, was discovered and disclosed by the Trend Micro Zero Day Initiative.
Read More -
Join us as we delve into the mysterious world of the "search" or "search-ms" URI protocol attack. Threat actors craft deceptive emails and compromised websites to trick users into executing malicious code disguised as trusted files.
Read More
Related rules
- Search-ms and WebDAV Indicators in URL
- WebDAV Temporary Local File Creation
- Okta FastPass Phishing Detection
- Download From Suspicious TLD - Whitelist
- Suspicious Microsoft OneNote Child Process