Outbound WebDAV request to Stealth Falcon campaign staging directory

Duo Tech@duotech

•updated Jul 21, 2026•3•0•2

This rule detects outbound HTTP requests using the WebDAV protocol that target specific directory paths associated with the Stealth Falcon campaign staging activity. Such traffic may indicate a compromised host attempting to download tools or payloads from an adversary-controlled infrastructure.