WebDAV PUT Request to External Share

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

This rule detects HTTP PUT requests where the User-Agent header contains 'WebDAV' and the destination IP address is not a private or loopback address. This activity could indicate an attempt to exfiltrate data to an external WebDAV share.