{"id":"1ae64f96-72b6-48b3-ad3d-e71dff6c6398","title":"Suspicious External WebDAV Execution","description":"Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.\n","author":"Ahmed Farouk","status":"test","level":"high","date":"2024-05-10","modified":"","tags":["attack.initial-access","attack.resource-development","attack.t1584","attack.t1566"],"technique_ids":["T1566","T1584"],"logsource":{"category":"proxy"},"falsepositives":["Unknown"],"references":["https://dear-territory-023.notion.site/WebDav-Share-Testing-e4950fa0c00149c3aa430d779b9b1d0f?pvs=4","https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462","https://www.trendmicro.com/en_no/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html","https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html"],"source_path":"rules/web/proxy_generic/proxy_webdav_external_execution.yml","source_sha256":"eddecfb0bf1104fe9ac85a02c031843b46186faa3dcbf9aab0d5121fa3f971f6","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/proxy_generic/proxy_webdav_external_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious External WebDAV Execution\nid: 1ae64f96-72b6-48b3-ad3d-e71dff6c6398\nrelated:\n    - id: 4c55738d-72d8-490e-a2db-7969654e375f\n      type: similar\nstatus: test\ndescription: |\n    Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.\nreferences:\n    - https://dear-territory-023.notion.site/WebDav-Share-Testing-e4950fa0c00149c3aa430d779b9b1d0f?pvs=4\n    - https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462\n    - https://www.trendmicro.com/en_no/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html\n    - https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html\nauthor: Ahmed Farouk\ndate: 2024-05-10\ntags:\n    - attack.initial-access\n    - attack.resource-development\n    - attack.t1584\n    - attack.t1566\nlogsource:\n    category: proxy\ndetection:\n    selection_webdav:\n        c-useragent|startswith: 'Microsoft-WebDAV-MiniRedir/'\n        cs-method: 'GET'\n    selection_execution:\n        c-uri|endswith:\n            - '.7z'\n            - '.bat'\n            - '.dat'\n            - '.cmd'\n            - '.exe'\n            - '.js'\n            - '.lnk'\n            - '.ps1'\n            - '.rar'\n            - '.url'\n            - '.vbe'\n            - '.vbs'\n            - '.zip'\n    filter_main_local_ips:\n        dst_ip|cidr:\n            - '127.0.0.0/8'\n            - '10.0.0.0/8'\n            - '172.16.0.0/12'\n            - '192.168.0.0/16'\n            - '169.254.0.0/16'\n            - '::1/128'  # IPv6 loopback\n            - 'fe80::/10'  # IPv6 link-local addresses\n            - 'fc00::/7'  # IPv6 private addresses\n    condition: all of selection_* and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1566","id":"T1566","name":"Phishing","page":"techniques/enterprise/T1566/"},{"key":"enterprise/T1584","id":"T1584","name":"Compromise Infrastructure","page":"techniques/enterprise/T1584/"}],"data_path":"data/detection-rules/1ae64f96-72b6-48b3-ad3d-e71dff6c6398.json","kind":"sigma"}