WebDAV Delivery of Executable Files over HTTP (Zeek)
Flags Zeek HTTP events where WebDAV traffic serves an .exe with MIME type 'dosexec'.
- Product
- zeek
- Service
- http
- Author
- SOC Prime, Adam Swan (SigmaHQ), DRL 1.1
- Published
- 2020-05-01
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags HTTP sessions where the client appears to use WebDAV and the requested URI targets an executable. It correlates a WebDAV user agent/URI indicator with a response MIME type containing "dosexec" and a URI ending in ".exe". Attackers may use WebDAV to stage and deliver binaries for follow-on execution, so matching this behavior helps identify potential command-and-control or initial payload transfer. It relies on Zeek HTTP telemetry fields including client user agent, request URI, and response MIME types.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: WebDAV Delivery of Executable Files over HTTP (Zeek)
id: 8a5063d6-4887-4393-9f0c-6c9efc5277d5
status: test
description: This rule flags HTTP sessions where the client appears to use WebDAV and the requested URI targets an executable. It correlates a WebDAV user agent/URI indicator with a response MIME type containing "dosexec" and a URI ending in ".exe". Attackers may use WebDAV to stage and deliver binaries for follow-on execution, so matching this behavior helps identify potential command-and-control or initial payload transfer. It relies on Zeek HTTP telemetry fields including client user agent, request URI, and response MIME types.
references:
- http://carnal0wnage.attackresearch.com/2012/06/webdav-server-to-download-custom.html
- https://github.com/OTRF/detection-hackathon-apt29
- https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_http_executable_download_from_webdav.yml
author: SOC Prime, Adam Swan, Huntrule Team
date: 2020-05-01
modified: 2021-11-27
tags:
- attack.command-and-control
- attack.t1105
logsource:
product: zeek
service: http
detection:
selection_webdav:
- c-useragent|contains: WebDAV
- c-uri|contains: webdav
selection_executable:
- resp_mime_types|contains: dosexec
- c-uri|endswith: .exe
condition: selection_webdav and selection_executable
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: aac2fd97-bcba-491b-ad66-a6edf89c71bf
type: derived