Potential WebDAV DLL Execution via Ordinal Export
Detects potential DLL execution from a WebDAV-over-HTTPS path by identifying command lines containing @SSL and an ordinal-based DLL export pattern such as ,#1. This activity may indicate remote payload execution through tools such as rundll32.exe.
Microsoft Sentinel (KQL)
