I recently bought and Installed a WAF (after much begging).
I have a DFS namespace called
\\mycompany.com\ which is based on my Active Directory domain name
mycompany.com. My website domain is
Users are mapped to DFS namespace
Now my WAF is reporting a generic attack disclosure from IPs originating from my surrounding geographic area pointing at
mycompany.com\ourfiles\etc\ Using Microsoft-WebDAV-MiniRedir/6.1.7601 (which is a Windows 7 WebDAV if I remember) over HTTP. I assume from users that took there laptops home.
Sometimes the folder path showing up is very specific, however not out of the ordinary for someones shortcut.
My question is how should I tackle this? I know the WAF will report just about anything odd. I am able to easily replicate this report by manually trying to map a network drive outside my network.
When I try to use a domain joined system from an external WAN to try to replicate this issue without manual mapping I am not able to. Also WebDav or Windows Authentication is not installed on the web server.
Edit: For clarification is there a security concern here? or is it completely benign?