Rundll32 loading DLL from GUID-structured WebDAV UNC share
Detects execution of rundll32.exe where the command line contains a path structured as a GUID, initiated by commonly abused parents such as cmd.exe or explorer.exe. This pattern is often used by malicious payloads to execute code from temporary or obfuscated directories while masquerading as a legitimate Windows process.
Microsoft Sentinel (KQL)
