Windows WebDAV User Agent Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•21

Detects the use of WebDAV by a client, specifically identifying the 'Microsoft-WebDAV-MiniRedir/' user agent during a GET request. This behavior is often associated with 'DownloadCradle' techniques used by adversaries to download malicious content or exfiltrate data.