APT42 Spearspecter WebDAV Initial Access
Detects the execution of rundll32.exe with command-line arguments used to connect to a remote WebDAV share. This technique was observed in the SpearSpecter campaign where APT42 abused the 'search-ms' URI handler to deliver a malicious LNK file from an attacker-controlled WebDAV server.
YARA-L
