search-ms URI Abuse Delivering .scr Files via WebDAV

Duo Tech@duotech

•updated Jul 21, 2026•0•0•0

This rule detects the abuse of the Windows 'search-ms' URI protocol handler to trigger a search against a remote WebDAV share for '.scr' (screensaver) files. This technique is often used to bypass security controls and trick users into executing malicious binaries hosted on attacker-controlled infrastructure.