Windows WebDAV User Agent

Title: Windows WebDAV User Agent
Status: test
Description:Detects WebDav DownloadCradle
References:
  -https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html
Author: Florian Roth (Nextron Systems)
Date: 2018-04-06
modified:2021-11-27
Tags:

• -'attack.command-and-control'
• -'attack.t1071.001'

Logsource:

• category: proxy

Detection:
  selection:
    c-useragent|startswith: 'Microsoft-WebDAV-MiniRedir/'
    cs-method: 'GET'
  condition:selection
Falsepositives:
  -Administrative scripts that download files from the Internet
  -Administrative scripts that retrieve certain website contents
  -Legitimate WebDAV administration
Level: high