Suspicious File Execution From Internet Hosted WebDAV Share
Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content from it. This technique has been observed in malicious LNK files, often used for initial access or execution of payloads from remote shares.
Sigma
