SpearSpecter WebDAV Search-MS Abuse via rundll32.exe
Detects the execution of rundll32.exe with davclnt.dll to establish a WebDAV connection, a technique used by APT42 in the SpearSpecter campaign for initial access via malicious search-ms links. Specifically, it looks for rundll32.exe executing the DavSetCookie function from davclnt.dll and captures the WebDAV server from the command line argument.
Splunk (SPL)
