Threat Huntmediumtest
WebDAV Temporary Local File Creation
Detects the creation of WebDAV temporary files with potentially suspicious extensions
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Hunting Hypothesis
Log Source
WindowsFile Event
ProductWindows← raw: windows
CategoryFile Event← raw: file_event
Events for file system activity including creation, modification, and deletion.
Detection Logic
Detection Logic1 selector
detection:
selection:
TargetFilename|contains: '\AppData\Local\Temp\TfsStore\Tfs_DAV\'
TargetFilename|endswith:
- '.7z'
- '.bat'
- '.dat'
- '.ico'
- '.js'
- '.lnk'
- '.ps1'
- '.rar'
- '.vbe'
- '.vbs'
- '.zip'
condition: selectionFalse Positives
Legitimate use of WebDAV in an environment
MITRE ATT&CK
Other
detection.threat-hunting
Rule Metadata
Rule ID
4c55738d-72d8-490e-a2db-7969654e375f
Status
test
Level
medium
Type
Threat Hunt
Created
Mon Aug 21
Author
Path
rules-threat-hunting/windows/file/file_event/file_event_win_webdav_tmpfile_creation.yml
Raw Tags
attack.initial-accessattack.resource-developmentattack.t1584attack.t1566detection.threat-hunting