Suspicious WebDAV Activity with RunMRU and Clipboard Access

Steven Lim@KQLWizard

•updated Mar 17, 2026•72•0•452

This rule detects suspicious activity involving the WebDAV client, specifically looking for scenarios where WebDAV connections to public IPs are initiated from a process that has recently modified the RunMRU registry key to include WebDAV parameters and executables like 'cmd' or 'net use', and has also accessed clipboard data. This combination of behaviors suggests potential credential theft or lateral movement attempts using WebDAV.