WebDAV Temporary Local File Creation with Suspicious Extensions

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•51

This rule detects the creation of temporary files within the WebDAV TfsStore directory that have suspicious file extensions. Attackers can leverage WebDAV to force authentication or to drop malicious files onto a system. The presence of executable or archive file extensions in this specific temporary directory is highly indicative of malicious activity, potentially related to initial access or resource development.