Zeek: Detect WebDAV User-Agent with HTTP PUT to local or RFC1918 addresses

ATT&CK techniques

Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
- T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
Impact

What it detects

This rule flags HTTP requests where the User-Agent contains "WebDAV" and the HTTP method is PUT. Such traffic can indicate uploading or staging data on WebDAV-enabled network shares, which may be abused for data exfiltration or other unauthorized writes. It relies on Zeek HTTP telemetry fields for the request method, User-Agent, and destination IP, excluding common local and reserved ranges defined by the rule's IP filters.

Reporting behind it

Related detections9 linkedT1048.003 — drag to rearrange

FTP Data Exfiltration via curl with Embedded Credentials

Suspicious Data Exfiltration via TFTP Client

Suspicious Finger Client Execution for Command and Control

Malicious dnscat2 DNS Tunneling C2 Traffic

Suspicious Data Transfer via curl to Raw IP Address

Linux Python CLI Web Server Execution via http.server or SimpleHTTPServer

Windows svchost.exe Spawning rundll32.exe with WebDav davclnt.dll DavSetCookie

PowerShell Script Exfiltration Attempt: Send-MailMessage with Attachments

Windows Suspicious Outbound SMTP Connections on Common Mail Ports

Zeek: Detect WebDAV User-Agent with HTTP PUT to local or RFC1918 addresses

Pivot detection · T1048.003 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

zeek-http-webdav-user-agent-with-put-method-to-local-network-705072a5

title: "Zeek: Detect WebDAV User-Agent with HTTP PUT to local or RFC1918 addresses"
id: 35a2cfa2-0113-4302-8137-88c27244d4c9
status: test
description: This rule flags HTTP requests where the User-Agent contains "WebDAV" and the HTTP method is PUT. Such traffic can indicate uploading or staging data on WebDAV-enabled network shares, which may be abused for data exfiltration or other unauthorized writes. It relies on Zeek HTTP telemetry fields for the request method, User-Agent, and destination IP, excluding common local and reserved ranges defined by the rule's IP filters.
references:
  - https://github.com/OTRF/detection-hackathon-apt29/issues/17
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_http_webdav_put_request.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2020-05-02
modified: 2024-03-13
tags:
  - attack.exfiltration
  - attack.t1048.003
logsource:
  product: zeek
  service: http
detection:
  selection:
    user_agent|contains: WebDAV
    method: PUT
  filter:
    id.resp_h|cidr:
      - 10.0.0.0/8
      - 127.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 169.254.0.0/16
  condition: selection and not filter
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 705072a5-bb6f-4ced-95b6-ecfa6602090b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL