WebDav Client Execution Via Rundll32.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•0

Detects "svchost.exe" spawning "rundll32.exe" with command arguments like "C:\windows\system32\davclnt.dll,DavSetCookie". This could be an indicator of exfiltration or use of WebDav to launch code (hosted on a WebDav server).