Kithu S

@KithuS

Completionist

1 follower1 download21 copies1 like208 views

1 detection

Filters

Last updated

All Time

Detection languages

Microsoft Sentinel (KQL)1

Platforms

Windows1

MITRE Techniques

Suspicious Rundll32 WebDAV Execution (ClickFix Variant)

KQL

Identifies execution of rundll32.exe with WebDAV functionality (davclnt.dll, DavSetCookie) and UNC paths using @port syntax. This behavior is indicative of remote DLL retrieval over HTTP and may be associated with ClickFix variants abusing LOLBins for payload delivery and execution.

Kithu S@KithuS

Detections.ai Community

7 months ago

211208