WebDAV File Upload Exfiltration

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects potential WebDAV file upload exfiltration attempts by monitoring HTTP traffic for the 'PROPFIND' method. It uses a threshold of 10 occurrences within 60 seconds from the same source IP address to identify suspicious activity, indicating a possible attempt to enumerate or exfiltrate files via WebDAV.