frack113
6abf058185
update: Communication To Uncommon Destination Ports - Add link-local address range update: Dfsvc.EXE Network Connection To Non-Local IPs - Update rule to use cidr modifier update: Microsoft Sync Center Suspicious Network Connections - Add link-local address range update: Network Connection Initiated By PowerShell Process - Update rule to use cidr modifier update: Office Application Initiated Network Connection To Non-Local IP - Update rule to use cidr modifier update: Outbound Network Connection To Public IP Via Winlogon - Add link-local address range update: Potential CVE-2023-23397 Exploitation Attempt - SMB - Update rule to use cidr modifier update: Potentially Suspicious Malware Callback Communication - Add link-local address range update: Potentially Suspicious Wuauclt Network Connection - Update rule to use cidr modifier update: Publicly Accessible RDP Service - Add link-local address range update: RDP Over Reverse SSH Tunnel - Update rule to use cidr modifier update: Rundll32 Internet Connection - Add link-local address range update: Script Initiated Connection to Non-Local Network - Update rule to use cidr modifier update: Search-ms and WebDAV Suspicious Indicators in URL - Add link-local address range update: Search-ms and WebDAV Suspicious Indicators in URL - Add link-local address range update: WebDav Put Request - Update rule to use cidr modifier --------- Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
44 lines
1.4 KiB
YAML
44 lines
1.4 KiB
YAML
title: Search-ms and WebDAV Suspicious Indicators in URL
|
|
id: 5039f3d2-406a-4c1a-9350-7a5a85dc84c2
|
|
status: experimental
|
|
description: Detects URL pattern used by search(-ms)/WebDAV initial access campaigns.
|
|
references:
|
|
- https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html
|
|
- https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462
|
|
author: Micah Babinski
|
|
date: 2023/08/21
|
|
modified: 2024/03/13
|
|
tags:
|
|
- attack.initial_access
|
|
- attack.t1584
|
|
- attack.t1566
|
|
logsource:
|
|
category: proxy
|
|
detection:
|
|
selection_search_ms:
|
|
c-uri|contains|all:
|
|
- 'search' # Matches on search:query= or search-ms:query=
|
|
- ':query='
|
|
- 'webdav'
|
|
selection_search_term:
|
|
c-uri|contains:
|
|
# Note: Add additional keywords for additional coverage
|
|
- 'agreement'
|
|
- 'invoice'
|
|
- 'notice'
|
|
- 'payment'
|
|
filter_main_local_ips:
|
|
dst_ip|cidr:
|
|
- '127.0.0.0/8'
|
|
- '10.0.0.0/8'
|
|
- '172.16.0.0/12'
|
|
- '192.168.0.0/16'
|
|
- '169.254.0.0/16'
|
|
- '::1/128' # IPv6 loopback
|
|
- 'fe80::/10' # IPv6 link-local addresses
|
|
- 'fc00::/7' # IPv6 private addresses
|
|
condition: all of selection_* and not 1 of filter_main_*
|
|
falsepositives:
|
|
- Unknown
|
|
level: high
|