WebDAV Mount Point Detection

Chaitanya B B@mralien

•updated Jul 11, 2025•4•1•26

This rule detects file events where the target object path indicates a WebDAV mount point, specifically looking for paths containing '\Device\Mup\;WebDavRedirector\.*\DavWWWRoot\.*' combined with a domain name or IP address. This pattern is often associated with forced authentication attempts or ingress tool transfer via WebDAV.