Suspicious External WebDAV Execution via Microsoft-WebDAV-MiniRedir

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•1•0•31

This rule detects attempts to execute files from external WebDAV shares. It specifically looks for HTTP GET requests where the User-Agent header starts with 'Microsoft-WebDAV-MiniRedir/' and the requested URI ends with common executable or script file extensions. This behavior is often observed in initial access campaigns where adversaries leverage WebDAV to deliver and execute malicious payloads.