Zeek HTTP: WebDAV User-Agent with PUT Method to Local Network

title: "Zeek HTTP: WebDAV User-Agent with PUT Method to Local Network"
id: 35a2cfa2-0113-4302-8137-88c27244d4c9
status: test
description: This rule identifies HTTP sessions where the User-Agent contains "WebDAV" and the request method is PUT, indicating clients attempting to write files via WebDAV. Such activity can be used for staging or data movement, including potential exfiltration to network shares. It relies on Zeek HTTP telemetry fields including method and user_agent, and narrows results by excluding requests to specific private and special network address ranges.
references:
  - https://github.com/OTRF/detection-hackathon-apt29/issues/17
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_http_webdav_put_request.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2020-05-02
modified: 2024-03-13
tags:
  - attack.exfiltration
  - attack.t1048.003
logsource:
  product: zeek
  service: http
detection:
  selection:
    user_agent|contains: WebDAV
    method: PUT
  filter:
    id.resp_h|cidr:
      - 10.0.0.0/8
      - 127.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 169.254.0.0/16
  condition: selection and not filter
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 705072a5-bb6f-4ced-95b6-ecfa6602090b
    type: derived