Executable from Webdav — Sigma Rule

Rule metadata and linked tags

Author: SOC Prime, Adam Swan. Source status: test; severity: medium. Source dates: 2020-05-01 / 2021-11-27.

{
  "product": "zeek",
  "service": "http"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 7267af9edbe6a8be0afe9c70ff3ba3fb965710f27392e6f31c17292071e80f0d

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Executable from Webdav
id: aac2fd97-bcba-491b-ad66-a6edf89c71bf
status: test
description: 'Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/'
references:
    - http://carnal0wnage.attackresearch.com/2012/06/webdav-server-to-download-custom.html
    - https://github.com/OTRF/detection-hackathon-apt29
author: 'SOC Prime, Adam Swan'
date: 2020-05-01
modified: 2021-11-27
tags:
    - attack.command-and-control
    - attack.t1105
logsource:
    product: zeek
    service: http
detection:
    selection_webdav:
        - c-useragent|contains: 'WebDAV'
        - c-uri|contains: 'webdav'
    selection_executable:
        - resp_mime_types|contains: 'dosexec'
        - c-uri|endswith: '.exe'
    condition: selection_webdav and selection_executable
falsepositives:
    - Unknown
level: medium

Original YAML and metadata in JSON

False positives

• Unknown

Source references

• http://carnal0wnage.attackresearch.com/2012/06/webdav-server-to-download-custom.html
• https://github.com/OTRF/detection-hackathon-apt29