Rare Connection to WebDAV Target
Description
Identifies rare connection attempts to a Web Distributed Authoring and Versioning (WebDAV) resource. Attackers may inject WebDAV paths in files or features opened by a victim user to leak their NTLM credentials via forced authentication.
Query · esql
from logs-endpoint.events.process-*, logs-windows.sysmon_operational-*, logs-system.security-*, logs-windows.*, winlogbeat-*, logs-crowdstrike.fdr*, logs-m365_defender.event-* METADATA _id, _version, _index
| where
event.category == "process" and
event.type == "start" and
process.name == "rundll32.exe" and
process.command_line like "*DavSetCookie*"
| keep host.id, process.command_line, user.name, user.id
// extract the host from the WebDAV URL authority, excluding optional credentials and port
| grok process.command_line """(?i:https?)://(?:[^/@\s]+@)?(?<Esql.server_webdav_server>[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*)"""
| eval Esql.server_webdav_server = TO_LOWER(Esql.server_webdav_server)
| where
Esql.server_webdav_server is not null and
not Esql.server_webdav_server in ("www.google.com", "www.elastic.co", "google.com", "github.com", "www.github.com", "sharepoint.com", "live.net") and
not Esql.server_webdav_server like ("*.live.net", "*.sharepoint.com") and
// excludes private IP ranges
not Esql.server_webdav_server rlike """(10\.(\d{1,3}\.){2}\d{1,3}|172\.(1[6-9]|2\d|3[0-1])\.(\d{1,3}\.)\d{1,3}|192\.168\.(\d{1,3}\.)\d{1,3})"""
| stats
Esql.event_count = count(*),
Esql.host_id_count_distinct = count_distinct(host.id),
Esql.host_id_values = values(host.id),
Esql.user_name_values = values(user.name)
by Esql.server_webdav_server
| where
Esql.host_id_count_distinct == 1 and Esql.event_count <= 3
| eval host.id = MV_MIN(Esql.host_id_values), user.name = MV_MIN(Esql.user_name_values), destination.domain = MV_MIN(Esql.server_webdav_server)
| KEEP host.id, user.name, destination.domain, Esql.*
Implementation guide
This rule is designed for data generated by Elastic Defend, which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
Setup instructions: https://ela.st/install-elastic-defend
Additional data sources
This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
Analyst notes
Investigating Rare Connection to WebDAV Target
Possible investigation steps
- Examine the reputation of the destination domain or IP address.
- Verify if the target user opened any attachments or clicked links pointing to the same target within seconds from the alert timestamp.
- Correlate the findings with other security logs and alerts to identify any patterns or additional indicators of compromise related to the potential relay attack.
False positive analysis
- User accessing legit WebDAV resources.
Response and remediation
- Conduct a password reset for the target account that may have been compromised or are at risk, ensuring the use of strong, unique passwords.
- Verify whether other users were targeted but did not open the lure..
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine the full scope of the breach.
- Conduct a post-incident review to identify any gaps in security controls and update policies or procedures to prevent recurrence, ensuring lessons learned are applied to improve overall security posture.