-
Mounting Hidden or WebDav Remote Shares
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Initial Access Tactic: Lateral Movement Data Source: Elastic Endgame Data Source: Elastic Defend Data Source: Windows Security Event Logs Data Source: Microsoft Defender XDR Data Source: Sysmon Data Source: SentinelOne Data Source: Crowdstrike Resources: Investigation Guide Noise: Medium Performance: Normal Profile: Recommended Threat: WebDAV Abuse Rule Type: Event Correlation (EQL) Platform: Windows ·Identifies the use of net.exe to mount a WebDav or hidden remote share. This may indicate lateral movement or preparation for data exfiltration.
Read More -
Rare Connection to WebDAV Target
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Data Source: Elastic Defend Data Source: Windows Security Event Logs Data Source: Microsoft Defender XDR Data Source: Crowdstrike Resources: Investigation Guide Noise: Medium Performance: Normal Profile: Recommended Threat: Living off the Land Threat: WebDAV Abuse Rule Type: ES|QL Platform: Windows Data Source: Sysmon ·Identifies rare connection attempts to a Web Distributed Authoring and Versioning (WebDAV) resource. Attackers may inject WebDAV paths in files or features opened by a victim user to leak their NTLM credentials via forced authentication.
Read More -
Suspicious Execution from a WebDav Share
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Execution Data Source: Elastic Endgame Data Source: Elastic Defend Data Source: Windows Security Event Logs Data Source: Microsoft Defender XDR Data Source: Sysmon Data Source: SentinelOne Data Source: Crowdstrike Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Threat: WebDAV Abuse Rule Type: Event Correlation (EQL) Platform: Windows ·Identifies attempts to execute or invoke content from remote WebDAV shares. Adversaries may abuse WebDAV paths, public tunnels, or host@port UNC paths to run tools or scripts while reducing local staging on the victim file system.
Read More