WebDAV Malware Delivery Labs: Detecting AI-Accelerated Threat Operations

A recent Managed Detection and Response (MDR) engagement uncovered a disturbing evolution in adversarial infrastructure. What began as a single alert for an exposed web server quickly revealed a "malware delivery lab" hosting over 1,000 distinct artifacts. This server was not merely a dumping ground for payloads; it was a Quality Assurance (QA) hub where attackers systematically tested delivery paths, social engineering lures, and WebDAV (Web Distributed Authoring and Versioning) execution methods.

This discovery highlights a critical shift: attackers are adopting generative AI to operate like modern software product teams. By leveraging Large Language Models (LLMs) to generate sophisticated lure documents, detailed README files, and automate testing, they have drastically accelerated their kill chain. For defenders, this means the volume of attacks is increasing, and the quality of the social engineering is becoming harder to distinguish from legitimate business correspondence.

Technical Analysis

The Attack Vector: WebDAV as a C2 and Delivery Mechanism

The core of this infrastructure relies on the abuse of WebDAV. WebDAV is an extension of the HTTP protocol that allows clients to perform remote web content authoring operations. While useful for legitimate collaboration, it is a favorite among threat actors because:

1. Firewall Friendly: It operates over standard TCP ports 80 and 443, often bypassing strict egress filtering.
2. Native OS Integration: Windows natively supports WebDAV via the WebClient service, allowing remote shares to be mapped as local drives.
3. Obscurity: Traffic appears as standard HTTP/HTTPS, blending in with normal web browsing.

In this specific campaign, the exposed server hosted a "QA" environment containing multiple versions of malicious loaders, decoy documents, and configuration files. The adversaries used this lab to test which combinations of lures and payloads successfully evaded detection before deploying them in broad campaigns.

The AI Accelerator

Analysis of the artifacts indicates the use of generative AI to produce the lure content. The "README" documentation and phishing templates displayed a level of grammatical perfection and contextual relevance that suggests LLM assistance. This allows non-native speaking actors to launch high-fidelity business email compromise (BEC) or malware campaigns at scale.

Exploitation Status

• Active Exploitation: Confirmed. The server was live and hosting active malware at the time of discovery.
• Method: Initial access likely involves phishing emails containing links to the WebDAV server or documents that initiate WebDAV connections upon opening (e.g., via remote template injection).

Detection & Response

Detecting these labs requires looking for the abuse of the WebClient service and suspicious process spawning related to WebDAV paths. The following rules are designed to identify the operational security failures of the attackers (exposed labs) and the execution techniques on the endpoint.

---
title: Potential WebDAV Malware Delivery Lab Activity
id: 8a4f9c12-1b3d-4e5a-9f8b-2c3d4e5f6a7b
status: experimental
description: Detects processes interacting with suspicious WebDAV paths characteristic of malware delivery labs (e.g., DavWWWRoot).
references:
  - https://attack.mitre.org/techniques/T1078/002/
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_webdav_client:
    Image|endswith:
      - '\svchost.exe'
      - '\explorer.exe'
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains:
      - 'DavWWWRoot'
      - '@SSL'
      - 'http://'
      - 'https://'
  selection_suspicious_ext:
    CommandLine|contains:
      - '.exe'
      - '.dll'
      - '.bat'
      - '.vbs'
      - '.ps1'
  condition: selection_webdav_client and selection_suspicious_ext
falsepositives:
  - Legitimate use of WebDAV for file sharing (rare in modern enterprises)
level: high
---
title: Microsoft Office Loading Content from WebDAV
id: 9b5g0d23-2c4e-5f6a-0g9c-3d4e5f6a7b8c
status: experimental
description: Detects Office applications initiating processes or loading content from remote WebDAV shares, a common lure delivery mechanism.
references:
  - https://attack.mitre.org/techniques/T1566/001/
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\POWERPNT.EXE'
      - '\OUTLOOK.EXE'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\mshta.exe'
      - '\wscript.exe'
  selection_indicator:
    CommandLine|contains:
      - 'http'
      - 'https'
      - '\\\\'
  condition: selection_parent and selection_child and selection_indicator
falsepositives:
  - Low. Legitimate documents rarely spawn shells via web protocols.
level: critical


**KQL (Microsoft Sentinel / Defender)**

This query hunts for endpoints making outbound connections to known WebDAV paths or utilizing the WebClient service to interact with non-standard domains.

// Hunt for WebDAV related process execution and network connections
let WebDavProcesses = dynamic(['svchost.exe', 'explorer.exe', 'net.exe', 'net1.exe', 'winword.exe', 'excel.exe']);
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ WebDavProcesses or InitiatingProcessFileName in~ WebDavProcesses
| where ProcessCommandLine has "http" and (ProcessCommandLine has ".exe" or ProcessCommandLine has "DavWWWRoot" or ProcessCommandLine has "@SSL")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, FolderPath
| order by Timestamp desc


**Velociraptor VQL**

This artifact hunts for the presence of the WebClient service being enabled and recent processes that have executed files from remote WebDAV locations.

-- Hunt for WebDAV usage and WebClient service status
SELECT 
  Pid, 
  Name, 
  CommandLine, 
  Exe, 
  Username, 
  StartTime
FROM pslist()
WHERE CommandLine =~ "DavWWWRoot" 
   OR CommandLine =~ "@SSL"
   OR CommandLine =~ "https?://.*\\.exe"

-- Check if WebClient service is enabled (Persistence)
SELECT 
  Name, 
  DisplayName, 
  StartMode, 
  State
FROM wmi(service="SELECT * FROM Win32_Service WHERE Name='WebClient'")


**Remediation Script (PowerShell)**

Use this script to audit the WebClient service status on endpoints and identify recent suspicious network connections associated with WebDAV usage.

# Audit WebClient Service and WebDAV Hardening
Write-Host "[*] Auditing WebClient Service Status..."

$webClientService = Get-Service -Name WebClient -ErrorAction SilentlyContinue

if ($webClientService) {
    if ($webClientService.Status -eq 'Running') {
        Write-Host "[!] ALERT: WebClient Service is RUNNING. This allows WebDAV connections." -ForegroundColor Red
        Write-Host "[+] Recommendation: Disable WebClient Service if not required for business operations." -ForegroundColor Yellow
        # To disable (Uncomment to remediate):
        # Stop-Service -Name WebClient -Force
        # Set-Service -Name WebClient -StartupType Disabled
    } else {
        Write-Host "[+] WebClient Service is currently stopped." -ForegroundColor Green
    }
} else {
    Write-Host "[+] WebClient Service is not installed on this system." -ForegroundColor Green
}

# Check for recent WebDAV related network connections (Requires Admin)
Write-Host "[*] Checking for recent WebDAV related network events..."
$events = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Kernel-Process/Analytic'; ID=1} -ErrorAction SilentlyContinue
# Note: In a real environment, query Sysmon or ForwardedEvents for NetworkConnect logs
# Simulating a check for common WebDAV client processes
$suspiciousProcs = @('svchost', 'explorer', 'net', 'net1')
Get-Process | Where-Object {$suspiciousProcs -contains $_.Name} | Select-Object ProcessName, Id, Path

Remediation

1. Disable the WebClient Service The most effective immediate mitigation is to disable the WebClient service on all workstations unless strictly required. This prevents the system from mapping WebDAV shares.

• Windows: sc stop WebClient && sc config WebClient start= disabled
• Group Policy: Computer Configuration -> Administrative Templates -> Network -> WebClient Client -> Turn off WebClient Client.

2. Network Segmentation and Filtering

• Implement strict egress filtering on ports 80 and 443. While you cannot block all web traffic, use next-gen firewalls to inspect WebDAV methods (PROPFIND, PROPPATCH, MKCOL, COPY, MOVE).
• Block access to known malicious IP ranges and domains associated with the identified delivery lab.

3. Awareness Training

• Update security awareness training to include examples of AI-generated phishing. Emphasize checking URLs even if the content context appears highly personalized and grammatically perfect.

4. Vulnerability Scanning

• Conduct external and internal vulnerability scans to identify exposed WebDAV endpoints. Ensure that any WebDAV enabled servers require strong authentication and are not exposed anonymously to the internet.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub