Pushd Mounts Remote WebDAV Share via @SSL Notation
Detects the use of the 'pushd' command in combination with a WebDAV share path utilizing the '@SSL' notation. This technique can be used by attackers to force the connection to a remote WebDAV share, potentially triggering NTLM credential relay or accessing malicious remote resources. The inclusion of 'rundll32' in the condition suggests monitoring for process proxying or exploitation chains often associated with such connections.
Cortex XDR
