{"id":"705072a5-bb6f-4ced-95b6-ecfa6602090b","title":"WebDav Put Request","description":"A General detection for WebDav user-agent being used to PUT files on a WebDav network share. This could be an indicator of exfiltration.","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"low","date":"2020-05-02","modified":"2024-03-13","tags":["attack.exfiltration","attack.t1048.003"],"technique_ids":["T1048.003"],"logsource":{"product":"zeek","service":"http"},"falsepositives":["Unknown"],"references":["https://github.com/OTRF/detection-hackathon-apt29/issues/17"],"source_path":"rules/network/zeek/zeek_http_webdav_put_request.yml","source_sha256":"ca22bd7c8e38f56d3e7c59bd4ae2d6253b20a90a704764e8df159716004e15bb","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/zeek/zeek_http_webdav_put_request.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: WebDav Put Request\nid: 705072a5-bb6f-4ced-95b6-ecfa6602090b\nstatus: test\ndescription: A General detection for WebDav user-agent being used to PUT files on a WebDav network share. This could be an indicator of exfiltration.\nreferences:\n    - https://github.com/OTRF/detection-hackathon-apt29/issues/17\nauthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)\ndate: 2020-05-02\nmodified: 2024-03-13\ntags:\n    - attack.exfiltration\n    - attack.t1048.003\nlogsource:\n    product: zeek\n    service: http\ndetection:\n    selection:\n        user_agent|contains: 'WebDAV'\n        method: 'PUT'\n    filter:\n        id.resp_h|cidr:\n            - '10.0.0.0/8'\n            - '127.0.0.0/8'\n            - '172.16.0.0/12'\n            - '192.168.0.0/16'\n            - '169.254.0.0/16'\n    condition: selection and not filter\nfalsepositives:\n    - Unknown\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1048.003","id":"T1048.003","name":"Exfiltration Over Unencrypted Non-C2 Protocol","page":"techniques/enterprise/T1048.003/"}],"data_path":"data/detection-rules/705072a5-bb6f-4ced-95b6-ecfa6602090b.json","kind":"sigma"}