Windows File Events: WebDAV Temporary Files Created with Suspicious Extensions

Flags creation of WebDAV temporary files on Windows in a Tfs_DAV temp path with executable/archive-like extensions.

FreeUnreviewedSigmamediumv1

windows-file-events-webdav-temporary-files-created-with-suspicious-extensions-4c55738d

title: "Windows File Events: WebDAV Temporary Files Created with Suspicious Extensions"
id: 23716f78-d72d-48e7-a674-2d2d0a5c4fd5
related:
  - id: 1ae64f96-72b6-48b3-ad3d-e71dff6c6398
    type: similar
  - id: 4c55738d-72d8-490e-a2db-7969654e375f
    type: derived
status: test
description: This rule matches Windows file creation events where the TargetFilename contains a WebDAV temporary storage path under AppData\Local\Temp\TfsStore\Tfs_DAV\ and ends with potentially suspicious executable or archive extensions. Attackers may leverage WebDAV to stage or drop files during initial access or resource development, using these temporary artifacts to avoid detection. The detection relies on telemetry that records file event paths, specifically TargetFilename values containing the expected directory and file extension patterns.
references:
  - https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html
  - https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462
  - https://dear-territory-023.notion.site/WebDav-Share-Testing-e4950fa0c00149c3aa430d779b9b1d0f?pvs=4
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/file/file_event/file_event_win_webdav_tmpfile_creation.yml
author: Micah Babinski, Huntrule Team
date: 2023-08-21
tags:
  - attack.initial-access
  - attack.resource-development
  - attack.t1584
  - attack.t1566
  - detection.threat-hunting
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains: \AppData\Local\Temp\TfsStore\Tfs_DAV\
    TargetFilename|endswith:
      - .7z
      - .bat
      - .dat
      - .ico
      - .js
      - .lnk
      - .ps1
      - .rar
      - .vbe
      - .vbs
      - .zip
  condition: selection
falsepositives:
  - Legitimate use of WebDAV in an environment
level: medium
license: DRL-1.1

What it detects

This rule matches Windows file creation events where the TargetFilename contains a WebDAV temporary storage path under AppData\Local\Temp\TfsStore\Tfs_DAV\ and ends with potentially suspicious executable or archive extensions. Attackers may leverage WebDAV to stage or drop files during initial access or resource development, using these temporary artifacts to avoid detection. The detection relies on telemetry that records file event paths, specifically TargetFilename values containing the expected directory and file extension patterns.

Known false positives

Legitimate use of WebDAV in an environment

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.