WebDav Client Execution Via Rundll32.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•25

Detects 'svchost.exe' spawning 'rundll32.exe' with command arguments like 'C:\windows\system32\davclnt.dll,DavSetCookie'. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on a WebDav server).