Suspicious WebDAV Client Execution Via Rundll32.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•22

Detects 'svchost.exe' spawning 'rundll32.exe' with command arguments indicating the use of 'davclnt.dll,DavSetCookie' and a remote IP address. This activity is suspicious as it can be an indicator of data exfiltration, execution of code hosted on a WebDAV server, or exploitation related to CVE-2023-23397, particularly for NTLM hash theft.