Potentially Suspicious WebDAV LNK Execution
Detects the execution of various scripting interpreters or command-line tools via a LNK file accessed from a WebDAV share. This technique is often used by adversaries to bypass security controls and execute malicious code, leveraging the `DavWWWRoot` path to indicate WebDAV access. The parent process is expected to be `explorer.exe`, suggesting user interaction.
Sigma
