Rundll32 Remote WebDAV Payload
Detects rundll32.exe executing with UNC path arguments, indicative of a remote WebDAV payload loaded directly into memory. This behavior has been observed in campaigns such as ClearFake and ClickFix.
Microsoft Sentinel (KQL)
