Rundll32 Initiated by Explorer.exe with Network/WebDAV Parameters

Ankit Mehta@Secvyn

•updated Jun 12, 2026•0•0•1

Detects instances where rundll32.exe is launched by explorer.exe and includes command-line parameters indicative of network communication (http, https) or WebDAV activity (davclnt.dll, WebDAV, \\). This behavior can be associated with forced authentication attempts or execution of remote code.