AI-Assisted Social Engineering: Detecting WebDAV Delivery and Infostealer Campaigns

Introduction

The discovery of an exposed command-and-control (C2) server by Rapid7 provides a rare, unfiltered look into the "factory floor" of modern cybercrime. The cache of 1,048 files—ranging from lure templates to dropper builders—reveals a sophisticated operation leveraging Artificial Intelligence to refine social engineering attacks and the WebDAV protocol to deliver malware.

This is not a theoretical proof-of-concept. The toolkit contained two active campaign chains, one of which was already operational against Windows users in Mexico, using a fake government ID-lookup site as a lure to deploy an infostealer. For defenders, this signals a critical escalation: AI lowers the barrier for creating convincing lures, while WebDAV abuse provides a transport mechanism that often bypasses standard network egress filtering. Immediate action is required to detect this protocol abuse and harden endpoints against these delivery vectors.

Technical Analysis

The AI-Enhanced Toolkit The exposed server demonstrates a maturation in attacker workflow. The inclusion of "builder notes" and "execution experiments" suggests an iterative development process. Crucially, the use of AI assistance in generating lure templates means that phishing emails and landing pages are increasingly likely to be grammatically perfect, contextually relevant, and tailored to specific regional demographics—such as the Mexican government site spoofing observed in this campaign.

The Attack Chain

Initial Access: The victim is directed to a credential harvesting page (the fake government ID site) via spear-phishing or SEO poisoning.
Delivery Mechanism: Rather than downloading the payload directly via HTTP GET, the malware utilizes the Web Distributed Authoring and Versioning (WebDAV) protocol.
Staging: WebDAV allows the attacker to mount a remote server as a local folder (often using net use or the WebClient service). This technique is frequently used to bypass network perimeter defenses that inspect executable downloads but allow standard web traffic.
Execution: An infostealer payload is retrieved and executed on the Windows host.

Platform: Windows Status: Confirmed Active Exploitation (In-the-wild)

The abuse of WebDAV is particularly insidious because it tunnels file operations over ports 80 or 443. If an organization allows outbound HTTP/HTTPS without deep packet inspection (DPI) capable of identifying WebDAV methods (PROPFIND, PROPPATCH, etc.), attackers can treat a remote server like a local hard drive.

Detection & Response

Sigma Rules

The following Sigma rules focus on the abnormal use of the WebDAV client and the mapping of remote drives, which are core TTPs observed in this campaign structure.

YAML

---
title: WebDAV Client Mapping Remote Drive via Net Use
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects the use of net.exe to map a remote WebDAV share (http/https) to a local drive letter. This is a common technique to bypass perimeter controls for malware staging.
references:
  - https://attack.mitre.org/techniques/T1078/002/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains:
      - ' use '
    CommandLine|contains:
      - 'http://'
      - 'https://'
  condition: selection
falsepositives:
  - Legitimate administrative use of WebDAV resources (rare in typical enterprise environments)
level: high
---
title: PowerShell WebClient WebDAV Request
id: b1c2d3e4-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects PowerShell scripts attempting to interact with WebDAV endpoints using the WebClient class, often used for staging payloads.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'System.Net.WebClient'
      - 'DownloadFile'
    CommandLine|contains:
      - 'http://'
      - 'https://'
  filter_legit_domains:
    CommandLine|contains:
      - 'microsoft.com'
      - 'windowsupdate.com'
  condition: selection and not filter_legit_domains
falsepositives:
  - Administrative scripts downloading from internal web servers
level: medium

KQL (Microsoft Sentinel / Defender)

This query hunts for processes establishing connections or invoking commands related to WebDAV mounting. It correlates process creation with network events to identify suspicious net use activity.

KQL — Microsoft Sentinel / Defender

// Hunt for WebDAV mapping activity
let ProcessEvents = materialize (
    DeviceProcessEvents
    | where Timestamp > ago(7d)
    | where (FileName has @"net.exe" or FileName has @"net1.exe") 
           and ProcessCommandLine has " use " 
           and (ProcessCommandLine has "http://" or ProcessCommandLine has "https://")
    | project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessAccountName, SHA256
);
let NetworkEvents = materialize (
    DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where RemotePort in (80, 443) and InitiativeProcessCommandLine has "http"
    | summarize count() by Timestamp, DeviceName, RemoteUrl
);
ProcessEvents
| join kind=inner NetworkEvents on Timestamp, DeviceName
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, RemoteUrl, SHA256
| extend HuntContext = "Potential WebDAV Staging Activity"

Velociraptor VQL

This VQL artifact hunts for the usage of the WebClient service DLL (webclient.dll) loaded by processes, which is required for WebDAV functionality, as well as command line artifacts related to drive mapping.

VQL — Velociraptor

-- Hunt for WebDAV indicators
SELECT 
  Pid, 
  Name, 
  CommandLine, 
  Exe,
  Username,
  Ctime as CreateTime
FROM pslist()
WHERE CommandLine =~ 'net use'
   AND (CommandLine =~ 'http://' OR CommandLine =~ 'https://')

UNION

SELECT 
  Pid,
  Name,
  Exe,
  Username
FROM process_loaded_modules()
WHERE Name =~ 'webclient.dll'
  AND Name !~ 'svchost.exe'  -- Filter out system host unless suspicious

Remediation Script (PowerShell)

This script audits the WebClient service status—which enables the WebDAV redirector functionality—and provides options to disable it if it is not required for business operations.

PowerShell

<#
.SYNOPSIS
    Audit and Disable WebDAV WebClient Service to prevent malware staging.
.NOTES
    File Name      : Remediate-WebDAV.ps1
    Author         : Security Arsenal
    Prerequisite   : Run as Administrator
#>

function Disable-WebDAVService {
    $serviceName = "WebClient"
    $service = Get-Service -Name $serviceName -ErrorAction SilentlyContinue

    if ($null -eq $service) {
        Write-Host "[INFO] WebClient service is not present on this system." -ForegroundColor Cyan
        return
    }

    if ($service.Status -eq "Running") {
        Write-Host "[WARNING] WebClient service is currently running. This is a risk for WebDAV-based malware delivery." -ForegroundColor Yellow
        Write-Host "[ACTION] Stopping and disabling the WebClient service..." -ForegroundColor Red
        
        Stop-Service -Name $serviceName -Force -ErrorAction Stop
        Set-Service -Name $serviceName -StartupType Disabled -ErrorAction Stop
        Write-Host "[SUCCESS] WebClient service stopped and disabled." -ForegroundColor Green
    }
    elseif ($service.StartType -ne "Disabled") {
        Write-Host "[INFO] WebClient service is present but not running. Current Startup Type: $($service.StartType)" -ForegroundColor Cyan
        Write-Host "[ACTION] Setting Startup Type to Disabled..." -ForegroundColor Red
        Set-Service -Name $serviceName -StartupType Disabled -ErrorAction Stop
        Write-Host "[SUCCESS] WebClient service disabled." -ForegroundColor Green
    }
    else {
        Write-Host "[INFO] WebClient service is already disabled." -ForegroundColor Green
    }
}

# Execute Remediation
Disable-WebDAVService

Remediation

1. Network-Level Controls Block WebDAV traffic at the perimeter. Configure your proxy or next-generation firewall to inspect and block HTTP methods specific to WebDAV, including PROPFIND, PROPPATCH, MKCOL, DELETE, COPY, MOVE, LOCK, and UNLOCK. While standard web browsing uses GET and POST, these additional methods are rarely required for general business web traffic and are strong indicators of malicious staging activity.

2. Endpoint Hardening Disable the WebClient service on all Windows workstations unless there is a strict business requirement for WebDAV client functionality (e.g., specific legacy SharePoint integrations). The PowerShell script provided above can be deployed via Group Policy or Intune to automate this hardening across the enterprise.

3. User Awareness The AI-generated lures found in this campaign are highly convincing. Update security awareness training to specifically highlight government or tax-themed scams involving "ID verification" or "status lookups." Encourage users to verify URLs by navigating to official government portals manually rather than clicking links in emails or messages.

4. Allowlisting Implement application allowlisting (e.g., AppLocker) to prevent the execution of unsigned binaries or those dropped into unexpected user profile directories, which is a common behavior for infostealers delivered via these campaigns.

Related Resources

Security Arsenal Red Team Services AlertMonitor Platform Book a SOC Assessment pen-testing Intel Hub