Windows WebDAV Temporary File Creation with Suspicious Extensions
Flags creation of WebDAV temporary files on Windows in a Tfs_DAV temp path with executable/archive-like extensions.
- Product
- windows
- Category
- file_event
- Author
- Micah Babinski (SigmaHQ), DRL 1.1
- Published
- 2023-08-21
- Updated
- 2026-07-31
ATT&CK techniques
Resource Dev → Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags file creation events targeting the WebDAV temporary local storage path under AppData\Local\Temp\TfsStore\Tfs_DAV\ and ending with potentially risky extensions (e.g., .bat, .ps1, .vbs, .js, .lnk, .zip). Attackers may use WebDAV to stage and transfer executable or scriptable files, leveraging temporary local writes during access. It relies on Windows file event telemetry that includes the created TargetFilename for matching against the specified path and extension suffixes.
Reporting behind it
- trellix.comhttps://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html
- micahbabinski.medium.comhttps://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462
- dear-territory-023.notion.sitehttps://dear-territory-023.notion.site/WebDav-Share-Testing-e4950fa0c00149c3aa430d779b9b1d0f?pvs=4
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/file/file_event/file_event_win_webdav_tmpfile_creation.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows WebDAV Temporary File Creation with Suspicious Extensions
id: 23716f78-d72d-48e7-a674-2d2d0a5c4fd5
related:
- id: 1ae64f96-72b6-48b3-ad3d-e71dff6c6398
type: similar
- id: 4c55738d-72d8-490e-a2db-7969654e375f
type: derived
status: test
description: This rule flags file creation events targeting the WebDAV temporary local storage path under AppData\Local\Temp\TfsStore\Tfs_DAV\ and ending with potentially risky extensions (e.g., .bat, .ps1, .vbs, .js, .lnk, .zip). Attackers may use WebDAV to stage and transfer executable or scriptable files, leveraging temporary local writes during access. It relies on Windows file event telemetry that includes the created TargetFilename for matching against the specified path and extension suffixes.
references:
- https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html
- https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462
- https://dear-territory-023.notion.site/WebDav-Share-Testing-e4950fa0c00149c3aa430d779b9b1d0f?pvs=4
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/file/file_event/file_event_win_webdav_tmpfile_creation.yml
author: Micah Babinski, Huntrule Team
date: 2023-08-21
tags:
- attack.initial-access
- attack.resource-development
- attack.t1584
- attack.t1566
- detection.threat-hunting
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|contains: \AppData\Local\Temp\TfsStore\Tfs_DAV\
TargetFilename|endswith:
- .7z
- .bat
- .dat
- .ico
- .js
- .lnk
- .ps1
- .rar
- .vbe
- .vbs
- .zip
condition: selection
falsepositives:
- Legitimate use of WebDAV in an environment
level: medium
license: DRL-1.1