Detectionhightest

Suspicious External WebDAV Execution

Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Ahmed FaroukCreated Fri May 101ae64f96-72b6-48b3-ad3d-e71dff6c6398web

Log Source

Proxy Log

CategoryProxy Log← raw: proxy

Detection Logic

detection:
    selection_webdav:
        c-useragent|startswith: 'Microsoft-WebDAV-MiniRedir/'
        cs-method: 'GET'
    selection_execution:
        c-uri|endswith:
            - '.7z'
            - '.bat'
            - '.dat'
            - '.cmd'
            - '.exe'
            - '.js'
            - '.lnk'
            - '.ps1'
            - '.rar'
            - '.url'
            - '.vbe'
            - '.vbs'
            - '.zip'
    filter_main_local_ips:
        dst_ip|cidr:
            - '127.0.0.0/8'
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '169.254.0.0/16'
            - '::1/128'  # IPv6 loopback
            - 'fe80::/10'  # IPv6 link-local addresses
            - 'fc00::/7'  # IPv6 private addresses
    condition: all of selection_* and not 1 of filter_main_*