ACR Stealer - Rundll32 WebDAV DLL Load
Detects rundll32.exe execution loading a DLL from a remote WebDAV share over HTTPS, including pushd-mounted WebDAV shares and @SSL/DavWWWRoot UNC indicators. Observed as the initial execution stage of ACR Stealer's Campaign 1, where a ClickFix prompt launches cmd.exe which invokes rundll32.exe against a GUID-based WebDAV path to fetch and load a malicious DLL.
YARA-L
