Zeek HTTP: Executable download over WebDAV by detecting WebDAV user-agent/URI and .exe MIME type

title: "Zeek HTTP: Executable download over WebDAV by detecting WebDAV user-agent/URI and .exe MIME type"
id: 8a5063d6-4887-4393-9f0c-6c9efc5277d5
status: test
description: This rule identifies HTTP sessions where a WebDAV client accesses a URI containing WebDAV indicators while the response suggests an executable payload (MIME type containing 'dosexec' and a URI ending in '.exe'). Attackers may use WebDAV to deliver executables to a victim because it blends into normal HTTP traffic patterns. Detection relies on Zeek HTTP logs, specifically the client user agent (c-useragent), requested URI (c-uri), and the response MIME type (resp_mime_types).
references:
  - http://carnal0wnage.attackresearch.com/2012/06/webdav-server-to-download-custom.html
  - https://github.com/OTRF/detection-hackathon-apt29
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_http_executable_download_from_webdav.yml
author: SOC Prime, Adam Swan, Huntrule Team
date: 2020-05-01
modified: 2021-11-27
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  product: zeek
  service: http
detection:
  selection_webdav:
    - c-useragent|contains: WebDAV
    - c-uri|contains: webdav
  selection_executable:
    - resp_mime_types|contains: dosexec
    - c-uri|endswith: .exe
  condition: selection_webdav and selection_executable
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: aac2fd97-bcba-491b-ad66-a6edf89c71bf
    type: derived