Rundll32 executes disguised DLL via WebDAV UNC path using ordinal #1

Ankit Mehta@Secvyn

•updated Sep 9, 2026•1•0•7

Detects the execution of rundll32.exe with a command line pointing to a WebDAV share path (DavWWWRoot). This technique is commonly used to execute remote payloads by forcing the system to access a remote resource, often as part of a malicious DLL loading chain.