CVE-2024-21412 chained .url shortcut leads to rundll32 spawned from cmd.exe

Ibrahim Saud@tektrix

•updated Sep 23, 2026•10•0•15

Detects a suspected exploitation attempt of CVE-2024-21412. The rule identifies a chain of execution involving an internet shortcut (.url) masquerading as a common file type (e.g., .jpg.url), which subsequently opens another shortcut to a WebDAV/IP host. This sequence is used to bypass Mark-of-the-Web (MotW) protections and execute a malicious batch script and Rundll32 process.