Proxy WebDAV MiniRedir Drives Execution from External Shares
Alert on external WebDAV MiniRedir GET requests for executable-like file extensions that may lead to execution.
- Category
- proxy
- Author
- Ahmed Farouk (SigmaHQ), DRL 1.1
- Published
- 2024-05-10
- Updated
- 2026-07-31
ATT&CK techniques
Resource Dev → Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags proxy requests where the client uses the WebDAV Explorer mini redirect user agent and issues GET requests to WebDAV URLs that end in executable or script archive extensions (e.g., .exe, .bat, .ps1, .zip, .lnk). Attackers often leverage WebDAV to stage and deliver payloads during initial access or follow-on execution attempts, so identifying these download patterns helps detect malicious delivery. It relies on proxy telemetry fields for the HTTP user agent, method, and full request URI, and filters out common local destination IP ranges.
Reporting behind it
- dear-territory-023.notion.sitehttps://dear-territory-023.notion.site/WebDav-Share-Testing-e4950fa0c00149c3aa430d779b9b1d0f?pvs=4
- micahbabinski.medium.comhttps://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462
- trendmicro.comhttps://www.trendmicro.com/en_no/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html
- trellix.comhttps://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_webdav_external_execution.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Proxy WebDAV MiniRedir Drives Execution from External Shares
id: bf50a20b-e0dd-4af6-92bc-7bb4784ef633
related:
- id: 4c55738d-72d8-490e-a2db-7969654e375f
type: similar
- id: 1ae64f96-72b6-48b3-ad3d-e71dff6c6398
type: derived
status: test
description: This rule flags proxy requests where the client uses the WebDAV Explorer mini redirect user agent and issues GET requests to WebDAV URLs that end in executable or script archive extensions (e.g., .exe, .bat, .ps1, .zip, .lnk). Attackers often leverage WebDAV to stage and deliver payloads during initial access or follow-on execution attempts, so identifying these download patterns helps detect malicious delivery. It relies on proxy telemetry fields for the HTTP user agent, method, and full request URI, and filters out common local destination IP ranges.
references:
- https://dear-territory-023.notion.site/WebDav-Share-Testing-e4950fa0c00149c3aa430d779b9b1d0f?pvs=4
- https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462
- https://www.trendmicro.com/en_no/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html
- https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_webdav_external_execution.yml
author: Ahmed Farouk, Huntrule Team
date: 2024-05-10
tags:
- attack.initial-access
- attack.resource-development
- attack.t1584
- attack.t1566
logsource:
category: proxy
detection:
selection_webdav:
c-useragent|startswith: Microsoft-WebDAV-MiniRedir/
cs-method: GET
selection_execution:
c-uri|endswith:
- .7z
- .bat
- .dat
- .cmd
- .exe
- .js
- .lnk
- .ps1
- .rar
- .url
- .vbe
- .vbs
- .zip
filter_main_local_ips:
dst_ip|cidr:
- 127.0.0.0/8
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 169.254.0.0/16
- ::1/128
- fe80::/10
- fc00::/7
condition: all of selection_* and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1