Suspicious Rundll32 WebDAV Execution (ClickFix Variant)

Kithu S@KithuS

•updated Mar 19, 2026•21•1•208

Identifies execution of rundll32.exe with WebDAV functionality (davclnt.dll, DavSetCookie) and UNC paths using @port syntax. This behavior is indicative of remote DLL retrieval over HTTP and may be associated with ClickFix variants abusing LOLBins for payload delivery and execution.