Threat Huntmediumtest

WebDAV Temporary Local File Creation

Detects the creation of WebDAV temporary files with potentially suspicious extensions

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Micah BabinskiCreated Mon Aug 214c55738d-72d8-490e-a2db-7969654e375fwindows
Hunting Hypothesis
Log Source
WindowsFile Event
ProductWindows← raw: windows
CategoryFile Event← raw: file_event

Events for file system activity including creation, modification, and deletion.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        TargetFilename|contains: '\AppData\Local\Temp\TfsStore\Tfs_DAV\'
        TargetFilename|endswith:
            - '.7z'
            - '.bat'
            - '.dat'
            - '.ico'
            - '.js'
            - '.lnk'
            - '.ps1'
            - '.rar'
            - '.vbe'
            - '.vbs'
            - '.zip'
    condition: selection
False Positives

Legitimate use of WebDAV in an environment

Rule Metadata
Rule ID
4c55738d-72d8-490e-a2db-7969654e375f
Status
test
Level
medium
Type
Threat Hunt
Created
Mon Aug 21
Path
rules-threat-hunting/windows/file/file_event/file_event_win_webdav_tmpfile_creation.yml
Raw Tags
attack.initial-accessattack.resource-developmentattack.t1584attack.t1566detection.threat-hunting
View on GitHub