WebDAV Retrieving PowerShell Script via Microsoft-WebDAV-MiniRedir

Tim Peck@timpeck

•updated Nov 11, 2025•0•30

This rule detects attempts to retrieve PowerShell scripts (.ps1) from an external server using WebDAV (PROPFIND method) with a 'Microsoft-WebDAV-MiniRedir/' user agent. This activity is often associated with adversaries attempting to transfer tools or malicious scripts into a compromised environment.