WSH Lure Loading WebDAV
Detects rundll32.exe loading davclnt.dll triggered by a .wsh script for WebDAV access. This activity can be indicative of an adversary attempting to force authentication to capture credentials or to facilitate ingress tool transfer.
Microsoft Sentinel (KQL)
