Windows Internet Hosted WebDAV Share Mount Via Net.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•12

Detects when an internet-hosted WebDAV share is mounted using the `net.exe` or `net1.exe` utility. This activity can be indicative of an adversary attempting to establish remote access or exfiltrate data by mounting a remote share.