High-volume WebDAV PROPFIND requests to onedrive.cv malware staging host
This rule monitors for a high volume of WebDAV PROPFIND HTTP requests directed toward a specific domain associated with malware staging activities. The detection threshold is set to 50 requests within a 300-second window, which is indicative of automated attempts to enumerate or download malicious content using the WebDAV protocol.
Suricata
