Proxy WebDAV MiniRedir Drives Execution from External Shares

ATT&CK techniques

Resource Dev → Initial Access

Recon
Resource Dev
- T1584Compromise Infrastructure
Initial Access
- T1566Phishing
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags proxy requests where the client uses the WebDAV Explorer mini redirect user agent and issues GET requests to WebDAV URLs that end in executable or script archive extensions (e.g., .exe, .bat, .ps1, .zip, .lnk). Attackers often leverage WebDAV to stage and deliver payloads during initial access or follow-on execution attempts, so identifying these download patterns helps detect malicious delivery. It relies on proxy telemetry fields for the HTTP user agent, method, and full request URI, and filters out common local destination IP ranges.

Reporting behind it

Related detections9 linkedT1566 — drag to rearrange

Windows WebDAV Temporary File Creation with Suspicious Extensions

Malicious Office 365 Email Rule Breach - On Behalf (via office365)

Suspicious AWS Console AiTM Phishing Kit API Endpoints

Suspicious PowerShell Download of updserc Archive to AppData via ClickFix

AWS CloudTrail SSM SendCommand Successful Execution for Instance

Okta FastPass blocks phishing authentication attempts via MFA

macOS Script Editor Spawns Suspicious Command-Line Interpreters

Suspicious Process Execution by Microsoft OneNote on Windows Child Programs

Windows DLL Search Order Hijacking: Suspicious DLL Writes to App Dependency Folders

Proxy WebDAV MiniRedir Drives Execution from External Shares

Pivot detection · T1566 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

suspicious-external-webdav-downloads-leading-to-execution-via-proxy-logs-1ae64f96

title: Proxy WebDAV MiniRedir Drives Execution from External Shares
id: bf50a20b-e0dd-4af6-92bc-7bb4784ef633
related:
  - id: 4c55738d-72d8-490e-a2db-7969654e375f
    type: similar
  - id: 1ae64f96-72b6-48b3-ad3d-e71dff6c6398
    type: derived
status: test
description: This rule flags proxy requests where the client uses the WebDAV Explorer mini redirect user agent and issues GET requests to WebDAV URLs that end in executable or script archive extensions (e.g., .exe, .bat, .ps1, .zip, .lnk). Attackers often leverage WebDAV to stage and deliver payloads during initial access or follow-on execution attempts, so identifying these download patterns helps detect malicious delivery. It relies on proxy telemetry fields for the HTTP user agent, method, and full request URI, and filters out common local destination IP ranges.
references:
  - https://dear-territory-023.notion.site/WebDav-Share-Testing-e4950fa0c00149c3aa430d779b9b1d0f?pvs=4
  - https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462
  - https://www.trendmicro.com/en_no/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html
  - https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_webdav_external_execution.yml
author: Ahmed Farouk, Huntrule Team
date: 2024-05-10
tags:
  - attack.initial-access
  - attack.resource-development
  - attack.t1584
  - attack.t1566
logsource:
  category: proxy
detection:
  selection_webdav:
    c-useragent|startswith: Microsoft-WebDAV-MiniRedir/
    cs-method: GET
  selection_execution:
    c-uri|endswith:
      - .7z
      - .bat
      - .dat
      - .cmd
      - .exe
      - .js
      - .lnk
      - .ps1
      - .rar
      - .url
      - .vbe
      - .vbs
      - .zip
  filter_main_local_ips:
    dst_ip|cidr:
      - 127.0.0.0/8
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 169.254.0.0/16
      - ::1/128
      - fe80::/10
      - fc00::/7
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL