{"id":"aac2fd97-bcba-491b-ad66-a6edf89c71bf","title":"Executable from Webdav","description":"Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/","author":"SOC Prime, Adam Swan","status":"test","level":"medium","date":"2020-05-01","modified":"2021-11-27","tags":["attack.command-and-control","attack.t1105"],"technique_ids":["T1105"],"logsource":{"product":"zeek","service":"http"},"falsepositives":["Unknown"],"references":["http://carnal0wnage.attackresearch.com/2012/06/webdav-server-to-download-custom.html","https://github.com/OTRF/detection-hackathon-apt29"],"source_path":"rules/network/zeek/zeek_http_executable_download_from_webdav.yml","source_sha256":"7267af9edbe6a8be0afe9c70ff3ba3fb965710f27392e6f31c17292071e80f0d","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/zeek/zeek_http_executable_download_from_webdav.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Executable from Webdav\nid: aac2fd97-bcba-491b-ad66-a6edf89c71bf\nstatus: test\ndescription: 'Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/'\nreferences:\n    - http://carnal0wnage.attackresearch.com/2012/06/webdav-server-to-download-custom.html\n    - https://github.com/OTRF/detection-hackathon-apt29\nauthor: 'SOC Prime, Adam Swan'\ndate: 2020-05-01\nmodified: 2021-11-27\ntags:\n    - attack.command-and-control\n    - attack.t1105\nlogsource:\n    product: zeek\n    service: http\ndetection:\n    selection_webdav:\n        - c-useragent|contains: 'WebDAV'\n        - c-uri|contains: 'webdav'\n    selection_executable:\n        - resp_mime_types|contains: 'dosexec'\n        - c-uri|endswith: '.exe'\n    condition: selection_webdav and selection_executable\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","page":"techniques/enterprise/T1105/"}],"data_path":"data/detection-rules/aac2fd97-bcba-491b-ad66-a6edf89c71bf.json","kind":"sigma"}